Windows 2000: save event logs and verify that they are readable

Before repairing or migrating a Windows 2000 computer, save its event logs. These steps create diagnostic copies without clearing the live logs. They are intended for an existing, isolated legacy system; exporting does not require internet access.

1. Identify the fault and computer

Record the computer name, Windows version and service pack, the time and the observed behaviour. Include the computer’s configured time zone and any known clock error. Do not change its clock while collecting evidence. An event number alone is not unique: include its source and description.

2. Open the relevant logs

Open Administrative Tools in Control Panel, then Event Viewer. Alternatively, find it under System Tools in Computer Management. Save at least System and Application separately. Server roles may provide additional logs. The Security log requires specific rights and contains events according to the configured auditing; do not change audit policies for this collection.

3. Save EVT first, then a readable supplement

  1. Select the required log. In its context menu choose Save Log File As, not Clear All Events.
  2. Save as Event Log (*.evt) in a new backup folder, for example PC01-System-2000-06-15.evt. Use the actual collection date and do not overwrite an earlier backup.
  3. Export the same log again as Text or CSV. This is a readable supplement, not a replacement for EVT. A running system may add events between the two exports.
  4. Repeat for each relevant log. Record the export time and log type in an accompanying file.

4. Actually open the backup

At the Event Viewer node choose Open Log File, select the saved EVT and the appropriate log type. The archive appears as a separate view. Check older and newer entries and specific events around the fault: source, event number and description must match the original. Open the text export too and check accented characters and multiline descriptions.

Then test a copy at the intended diagnostic workstation. Newer tools do not necessarily display old EVT files and their descriptions identically; missing descriptions can depend on unavailable message resources. Therefore retain the text export verified as readable on the source system and, if needed, the details of important individual events. Successful copying alone does not verify readability.

5. Limits and handover

An archive contains only events still present. Exporting cannot reconstruct overwritten events or actions that were never logged. Proximity in time does not prove a cause. Transfer the files securely to the person responsible for diagnosis: logs may contain user names, computer names and paths. Leave the original logs, size limits and overwrite rules unchanged for this backup. If an export is unreadable, resolve that before repair, reinstallation or migration.

Sources