OReilly Windows Server 2003 In A Nutshell Sep 2003 ISBN 0596004044

Event LogsNotes Critical system events requiring immediate attention are usually displayed in a pop-up alert or warning box on the screen of the server If the event is significant but doesn't require immediate attention, the event is logged instead to the System or Application log If you suspect your problem is hardware-related, filter your System log to show only those events generated by that component If you right-click on an event log Clear All Events, you can wipe out all the events in the log The exception is the Security log: if you clear the events in this log, a single new event is generated in the log that records the user who cleared the Security log You can't cover your tracks that easily! You can also use archived security logs to track resource-usage trends over time to help in planning for hardware and software upgrades on your network See Also Auditing, eventquery