Experiencing unexpected disconnections on your QuantVPS can be frustrating—especially during active trading. Fortunately, Windows Event Viewer is a powerful built-in tool that can help you identify whether a network disconnect originated from your VPS itself.
This guide forms a crucial part of broader troubleshooting for identifying and resolving network connectivity issues.
By creating a custom view, you can quickly filter for events related to network activity and spot possible causes of disconnections.
Step-by-Step Guide: Creating a Custom View to Track Network Events
1. Open Event Viewer
In the Windows search bar on your VPS, type “Event Viewer” and open the application.
2. Initiate Custom View Creation
In the right-hand Actions panel, click “Create Custom View…”
3. Configure Event Levels
In the Create Custom View window:
Check both “Warning” and “Information”.
These levels often include relevant entries about network disruptions.
4. Select Event Logs
Ensure “By log” is selected.
Expand the Event Logs dropdown.
Under Windows Logs, select System.
Under Applications and Services Logs, navigate to:
Microsoft > Windows > NetworkProfile > Operational
(Note: The original instructions reference “Applications and Services Logs” generally, but “NetworkProfile > Operational” targets network-specific events more accurately.)
5. Filter by Event IDs
In the Event ID field, enter:
27, 10000
Event Descriptions:
Event ID 27: Indicates a network adapter disconnect, which could stem from hardware issues, driver problems, or network configuration changes on your VPS.
Event ID 10000: Typically associated with DistributedCOM (DCOM) errors, often pointing to permission or communication issues affecting network stability.
6. Confirm Resource Usage (if prompted)
If a warning appears regarding memory or processor usage, click “Yes” to continue.
7. Name Your Custom View
Assign a descriptive name such as “Network Disconnects” or “VPS Network Issues”.
Click “OK”.
Your custom view will now appear under the Custom Views section in the left-hand pane.
Analyzing Your Network Logs
1. Review the Logs
Click on your newly created custom view.
If no disconnects occurred: The log area may be empty or show no warnings within the selected time frame.
If entries appear: Warnings or informational logs will indicate that a network connection or disconnection event took place.
2. Compare Timestamps
Compare the timestamps of any Warning or Information entries in Event Viewer with your trading platform’s logs (if available).
Interpretation:
If timestamps match: This strongly suggests that the disconnection was due to a network failure originating on your VPS. You may want to investigate your network settings or contact QuantVPS Support.
If timestamps do not match: The issue likely occurred outside the VPS, possibly due to a broker-side disconnection or application-level error.
Conclusion
⚠️ Note:
If you do not see any network-related events in the Event Viewer, then the issue is likely external. If you’re experiencing data feed disconnects, it may be related to your broker’s server. However, if you’re being disconnected from the VPS itself, it’s most likely due to instability in your local network — especially common when traveling or using public Wi-Fi connections.
By creating and analyzing a custom Event Viewer log, you gain valuable insight into the root cause of disconnections. This approach helps differentiate between issues stemming from your VPS and those related to external systems, allowing for faster and more precise troubleshooting.
**Advanced Troubleshooting**
To create a custom view in Event Viewer on Windows Server 2022 for monitoring network issues, follow these steps. This will help filter relevant events, such as connectivity problems, DNS failures, DHCP issues, IPsec errors, and network adapter disconnections. Network issues often appear in the System log under sources like Microsoft-Windows-DNS-Client, Microsoft-Windows-DHCP-Client, Microsoft-Windows-TCPIP, Microsoft-Windows-NetworkProfile, or NDIS drivers. Common indicators include errors or warnings with keywords like "network," "connection," "DNS," "IP," or "adapter."Step 1: Open Event Viewer
Press Windows key + R to open the Run dialog.
Type eventvwr and press Enter. This launches Event Viewer.
Step 2: Create a Custom View
In the left pane, expand Custom Views if it's not already.
Right-click Custom Views and select Create Custom View (or click Action > Create Custom View in the menu bar).
In the Create Custom View window, switch to the Filter tab.
Step 3: Configure the FilterUse these settings to target network-related events:
Logged: Select "Any time" (or a specific range like "Last 7 days" if you want recent events only).
Event level: Check Critical, Error, and Warning (network issues often show as errors or warnings, not just info).
By log: Select Event logs and check Windows Logs > System. Optionally, include Windows Logs > Security for IPsec or Netlogon-related security events, and Applications and Services Logs > Microsoft > Windows > DNS-Client or DHCP-Client for specific protocol issues.
Event sources: Click the dropdown and select relevant network-related sources, such as:
Microsoft-Windows-DNS-Client
Microsoft-Windows-DHCP-Client
Microsoft-Windows-NetworkProfile
Microsoft-Windows-TCPIP
Microsoft-Windows-WLAN-AutoConfig (if using Wi-Fi, though less common on servers)
NDIS or specific NIC drivers (e.g., e1iexpress for Intel adapters)
Event IDs: Enter a comma-separated list of common network issue IDs. Based on documented events, include these examples:
27 (network adapter disconnected or related issue)
55 (network failure in telemetry logs)
10000 (network connection or reconnection events)
1014 (DNS name resolution timeout)
4199 (TCP/IP address conflict)
4960-4984 (IPsec packet drops, integrity/replay failures, or negotiation issues, indicating potential network tampering or misconfigurations)
5027-5037 (Windows Firewall policy retrieval or initialization failures, which can affect network access)
5453, 5480-5485 (IPsec service or interface issues, posing security risks to network protection)
5827-5828 (Netlogon denied vulnerable secure channel connections, often due to network trust issues)
6145 (Group Policy processing errors, which can stem from network connectivity problems)
6273-6280 (Network Policy Server access denials, discards, or quarantines, common in RADIUS or VPN scenarios)
1030, 1053, 1054, 1058 (Group Policy failures often tied to domain connectivity or network reachability)
2021, 2022 (Server connection exhaustion or failures)
Keywords, User, Computer: Leave these as default unless you have specific needs (e.g., keywords like "Network" for broader filtering).
If you need to filter event descriptions (e.g., containing "connection failed" or "DNS timeout"), switch to the XML tab, check Edit query manually, and add a custom XPath query. For example:
<QueryList> <Query Id="0" Path="System"> <Select Path="System">*[System[(Level=1 or Level=2 or Level=3) and (EventID=27 or EventID=55 or EventID=10000)]]</Select> <Suppress Path="System">*[EventData[Data and (Data='unrelated text')]]</Suppress> </Query> </QueryList>
Customize the XML to include more IDs or description filters like *[EventData[Data[contains(.,'network') or contains(.,'connection')]]].
Step 4: Save the Custom View
Click OK.
In the Save Filter to Custom View dialog, enter a name like "Network Issues" and a description.
Choose a location under Custom Views.
Click OK to save. The view will now appear in the left pane under Custom Views.
Additional Tips
To view more detailed logs (e.g., analytic/debug for WLAN or diagnostics), go to View > Show Analytic and Debug Logs in Event Viewer, then navigate to Applications and Services Logs > Microsoft > Windows > UniversalTelemetryClient > Operational for events like ID 55 .
Refresh the view periodically or set up subscriptions/tasks to alert on these events.
If issues involve specific components like NPS, check pre-built views under Custom Views > Server Roles > Network Policy and Access Services .
For NDIS driver errors (common for Ethernet disconnections), look in the System log and note the event details .
This setup should capture most network issues. If your scenario involves specialized networking (e.g., Hyper-V or RDP), add relevant sources or IDs like 280 for Hyper-V vport errors . Test the view by simulating a minor issue, like unplugging a cable, and checking for new events.
Powershell Script:
# PowerShell script to create a custom view in Event Viewer for network issues
# This script generates an XML file and places it in the system-wide views directory.
# Run this script with administrative privileges.
# After running, restart Event Viewer to see the new custom view under "Custom Views".
# Define view details
$viewName = "Network Issues"
$description = "Custom view for monitoring network-related errors and warnings in Windows Server 2022."
$guid = (New-Guid).Guid
$viewsDirectory = "C:\ProgramData\Microsoft\Event Viewer\Views"
$filePath = Join-Path -Path $viewsDirectory -ChildPath "View_$guid.xml"
# Ensure the views directory exists (it should, but just in case)
if (-not (Test-Path $viewsDirectory)) {
New-Item -Path $viewsDirectory -ItemType Directory -Force
}
# XML content for the custom view
# This includes filters for System log with specific sources, levels (Critical=1, Error=2, Warning=3), and event IDs.
# Additional logs like Security and operational logs for DNS/DHCP are included where relevant.
# Event IDs are based on common network issues (e.g., connectivity, DNS, IPsec, etc.).
$xmlContent = @"
<?xml version="1.0" encoding="UTF-8"?>
<ViewerConfig>
<QueryConfig>
<QueryParams>
<UserQuery/>
</QueryParams>
<QueryNode>
<Name>$viewName</Name>
<Description>$description</Description>
<QueryList>
<Query Id="0" Path="System">
<Select Path="System">*[System[Provider[@Name='Microsoft-Windows-DNS-Client' or @Name='Microsoft-Windows-DHCP-Client' or @Name='Microsoft-Windows-NetworkProfile' or @Name='Microsoft-Windows-TCPIP' or @Name='Microsoft-Windows-WLAN-AutoConfig' or @Name='NDIS' or @Name='Microsoft-Windows-Kernel-PnP' or @Name='Microsoft-Windows-Resource-Exhaustion-Detector'] and (Level=1 or Level=2 or Level=3) and (EventID=27 or EventID=55 or EventID=10000 or EventID=1014 or EventID=4199 or (EventID>=4960 and EventID<=4984) or (EventID>=5027 and EventID<=5037) or EventID=5453 or (EventID>=5480 and EventID<=5485) or EventID=5827 or EventID=5828 or EventID=6145 or (EventID>=6273 and EventID<=6280) or EventID=1030 or EventID=1053 or EventID=1054 or EventID=1058)]]</Select>
<Select Path="Security">*[System[(Level=1 or Level=2 or Level=3) and (EventID=4960 or EventID=4961 or EventID=4962 or EventID=4963 or EventID=4964 or (EventID>=5027 and EventID<=5037) or EventID=5453 or (EventID>=5480 and EventID<=5485) or EventID=5827 or EventID=5828 or (EventID>=6273 and EventID<=6280))]]</Select>
<Select Path="Microsoft-Windows-DNS-Client/Operational">*[System[(Level=1 or Level=2 or Level=3)]]</Select>
<Select Path="Microsoft-Windows-DHCP-Client/Operational">*[System[(Level=1 or Level=2 or Level=3)]]</Select>
</Query>
</QueryList>
</QueryNode>
</QueryConfig>
</ViewerConfig>
"@
# Write the XML to file
$xmlContent | Out-File -FilePath $filePath -Encoding UTF8
Write-Output "Custom view created at: $filePath"
Write-Output "Restart Event Viewer to load the new view."
🤝 Need Assistance?
If any part of the setup feels unclear, the QuantVPS team is happy to help. If you’d like us to verify your environment from our side, feel free to open a support ticket and get connected with the team: https://www.quantvps.com/