A list of the common EventID’s I always want to search for but can never remember.
Log Name: Security EventID: 4624 – Discover Successful logon account ID’s local or on DCs
Log Name: System Source: bugcheck EventID: 1001 – the computer has rebooted from a bugcheck
Log Name: System Source: EventLog EventID: 6008 – previous system shutdown was unexpected
Log Name: System Source: srv EventID: 2013 – disk is at or near capacity