Questions[eventviewer](server)

According to the document here, the asterisk wildcard is supported and hence it should work in eg.

*[EventData[Data[@Name='TargetUserName'] ='User1*']]

but I cannot get any wildcard filter to work - has anyone been able to do this?

I can't find any events or log files,
are there such records somewhere or WD reports only if it finds something?

Windows 10 pro,
drive is encrypted with bitlocker (might affects somehow?)

I've searched online, but am unable to find any information; why this error is occurring?

It has flooded my Event Viewer: with an interval of 1 minute, this Error keeps popping up. (i.e. the frequency is 1 minute)

I don't have any IIS installed.

This server is purely a Domain controller and no other role has been added.

Please suggest what should I do?

Server OS - Window Server 2008 R2 Standard Edition.

More details:

Log Name:      System
Source:        Schannel
Date:          6/28/2012 6:06:11 PM
Event ID:      36888
Task Category: None
Level:         Error
Keywords:      
User:          SYSTEM
Computer:      QKSRVDC212.Corp.abc.com
Description:
The following fatal alert was generated: 10. The internal error state is 1203.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Schannel" Guid="{1F678132-5938-4686-9FDC-C8FF68F15C85}" />
    <EventID>36888</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2012-06-28T12:36:11.801245500Z" />
    <EventRecordID>9305</EventRecordID>
    <Correlation />
    <Execution ProcessID="524" ThreadID="3516" />
    <Channel>System</Channel>
    <Computer>QKSRVDC212.Corp.abc.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="AlertDesc">10</Data>
    <Data Name="ErrorState">1203</Data>
  </EventData>
</Event>

I'm trying to view the Shutdown Event Tracker logs in the Event Viewer, on windows server 2008 r8, but I can't find the messages that I supplied when previously restart the server.

Where in the Event Viewer can I see these logs?

I can check all kinds of error info with event viewer,

but I'm not yet aware of there is such utility in linux,

I can only check error logs of a specific application,

or is there such a tool in linux too?