How to Check Event Logs in Windows 10

To check event logs in Windows 10, right-click Start and select Event Viewer. Expand Windows Logs and select System for Windows and hardware events, or Application for app events. Errors are marked with a red icon. Select one to see details at the bottom.

For a simpler timeline of crashes and problems, search Start for reliability and open View reliability history.

Applies to: Windows 10. Checked on September 24, 2026.

Open Event Viewer

Use any of these:

• Right-click Start and select Event Viewer.
• Press Windows + R, type eventvwr.msc, and press Enter.
• Search Start for Event Viewer.
• Open Control Panel and select System and Security > Administrative Tools > Event Viewer.

Find the right log

In the left pane, expand Windows Logs:

• System covers Windows, drivers, and hardware, such as crashes, unexpected shutdowns, and services that fail to start.
• Application covers programs, such as an app that crashes or freezes.
• Security records sign-ins and security changes.
• Setup covers Windows updates and installs.

Show only errors

1. Select System (or Application).
2. In the Actions pane on the right, select Filter Current Log.

3. Check Critical and Error. Pick a time range under Logged if you like.

4. Select OK. Select Clear Filter later to see everything again.

To reuse a filter, select Create Custom View in the Actions pane instead, choose the same options, and give it a name. It appears under Custom Views in the left pane.

Understand an event

Select an event to see its details at the bottom. The most useful parts are:

• Level: Critical, Error, Warning, or Information.
• Source: the program or part of Windows that logged it.
• Event ID: a number you can search online along with the source.
• Date and Time: match it to when the problem happened.

Most PCs show some errors even when working normally. Focus on errors that happen at the same time as your problem.

Check crash and shutdown events

These events help explain crashes and sudden restarts. Find them with Filter Current Log on the System log by typing the number in Event IDs:

• 41 (source Kernel-Power): the PC restarted without shutting down cleanly, such as after a freeze, crash, or power loss.
• 1001 (source BugCheck): Windows restarted after a blue screen. The details include the stop code.
• 6008: the previous shutdown was unexpected.

After a blue screen, Windows may also save a small crash file in C:\Windows\Minidump.

Use Reliability Monitor for a simpler view

1. Search Start for reliability and select View reliability history.
2. Each day shows a stability graph. Red X icons mark app failures and Windows errors.
3. Select a day to see what went wrong, then double-click an item for details.

Reliability Monitor is easier to read than Event Viewer and shows crashes, failed updates, and app installs in one place.

Save or share a log

To send a log to someone helping you, select the log, then select Save All Events As (or Save Filtered Log File As) in the Actions pane.

Frequently asked questions

Is it safe to clear the event log?

Yes, but you’ll lose the history that helps with troubleshooting. There’s rarely a reason to clear it.

Why are there so many errors if my PC works fine?

Many errors are harmless, such as a service that retries and succeeds. Only worry about errors that match a real problem.

Can I see event logs from the command line?

Yes. In PowerShell, Get-WinEvent -LogName System -MaxEvents 20 shows the newest 20 System events.

On Windows 11, see how to check event logs in Windows 11. If crashes come from a driver, see how to update all drivers on Windows 10. More help is on our Windows Help & Guides page.

For blue screen crashes, the dump file often names the cause. See how to read dump files in Windows 10.