application log, security log, system log
.evt
When you select "Clear All Events", you will be prompted by Event viewer to save.
In Event Viewer, logon failure events are recorded in the "Security" log. Specifically, you can look for Event ID 4625, which indicates a failed logon attempt. This event provides details such as the username, domain, and the reason for the failure. You can access the Security log by expanding the "Windows Logs" section in Event Viewer.
Administrative Events log
Before you clear the event viewer you can go to the "Action" tab and "Save Log File AS.." to save the log file for later viewing.
Application
Open Event Viewer. Open another instance of Event Viewer and open the saved log file. Then you can view them side by side.
no event viewer
To create a log archive, follow these steps:Start Event Viewer, then select the log to be archived from the Log menu.Select Save As from the Log menu.In the Save As dialog box, select a directory and a log file name.Select a log format using the Save As Type drop-down list box.Choose Save.
uyhuh
uyhuh
uyhuh