Quick answer: Use Event Viewer (eventvwr.msc) to troubleshoot a Windows VPS. Check the Application, System, and Security logs, filter to Error and Critical, and read each event's source, ID, and timestamp. Correlate a crash by filtering logs to the time it occurred; repeated Event ID 4625 signals an RDP brute-force attempt.
When a Windows VPS misbehaves - a service stops, an application crashes, or logins fail - the Event Viewer is where the server records what happened. Reading it turns a vague "the site is down" into a specific cause. Here is how to use it effectively.
Run eventvwr.msc. The logs that matter most are under Windows Logs:
Application - errors from installed software and web apps System - drivers, services, and hardware events Security - logon successes and failures, policy changes
Each log is noisy, so filter it. Right-click a log, choose Filter Current Log, and select Error and Critical (add Warning if you are hunting an intermittent issue). This hides routine informational entries and leaves the events worth reading.
Click an event to see its source, Event ID, and a description of what failed. The Source tells you which component logged it, and the Event ID is a searchable identifier for that specific condition. Note the timestamp so you can correlate it with when the problem occurred.
If a site went down at a known time, filter the Application and System logs to that window. An application crash often appears alongside a service or app-pool failure at the same second, which points straight at the cause.
Repeated Event ID 4625 (failed logon) in the Security log signals a brute-force attempt, commonly against RDP. A flood of these is a strong reason to restrict RDP to known IPs and enforce account lockout.
Create a Custom View that shows only errors across Application and System logs, so you can check server health at a glance instead of rebuilding the filter each time.
Which log shows failed logins?
The Security log; repeated Event ID 4625 indicates failed logon attempts, often brute-force against RDP.
How do I check server health quickly?
Create a Custom View showing only errors across the Application and System logs.
On a SoftSys managed Windows VPS our team monitors the event logs proactively, so service failures and attack patterns are caught and acted on before they turn into downtime.
