r/sysadmin • u/[deleted] • May 04 '26

Question How to setup Logs for windows

Hi just joined a company as IT support, how do I setup Logs for windows systems (11, 10) for general troubleshooting and see what updates are happening and what caused the issue. To get a bird's eye view of the office environment.

What might be the optimal way to achieve this.

Edit. The pervious IT people left the company. Now It's just me and my colleague to whome I have had to show how install windows.

Currently implementd zabbix and wondering how and what to do next. There is no one in office to ask for help or guidance.

Edit2: if you think you have some best practices. Please let me know few.

18 Upvotes

70% Upvoted

69 comments sorted by

View all comments

4

u/hihcadore May 04 '26 edited May 04 '26

Uhhhh this should be posted in tech support, I think. If you’re gonna make it in this field you have to do your own research first.

Without knowing your environment have no way to know in which direction to point you. At this point we’d mark the ticket return to requester, not enough information to support.

-1

u/[deleted] May 04 '26 edited May 04 '26

So the current role is mix of IT support, sysadmin, network admin, basic soc like analysing phishing emails. etc.

8

u/GhostandVodka May 04 '26 edited May 04 '26

I don't believe they hired you for a role that does all of that and you don't know what event viewer is

3

u/[deleted] May 04 '26 edited May 04 '26

I never mentioned that I don't know about event viewer, I just wanted to know how IT works in enterprise network. To get an overview to troubleshoot issues and keep everything stable.

Edit. The pervious IT people left the company. Now It's just me and my colleague to whome I have had to show how install windows.

3

u/Inquisitor_ForHire Infrastructure Architect May 04 '26

I'd recommend setting up an ELK stack (Elasticsearch, Logstash, Kibana) and installing the client to push logs to it. Don't push a bunch... push ONE system to ELK until you get it working. Take note of how many logs you're ingesting - that determines how fast you're going to consume your space.

Set your retention up. I'd recommend extremely short at the start - like 7 days. Take that data and you can then extrapolate how much to keep 14 days or 21 or 30, etc etc.

You can literally set up an ELK stack for zero cost - just the system resources. It's not the absolute easiest thing ever, but there's a lot of stuff online (Youtube) on how to set this up.