Menu
Is free
registration
the main  /  Firmware/ Where to find the windows 7 system log. Where is the windows event log?

Where to find the windows 7 system log. Where is the windows event log?

In the OS of the Windows line, all the main events that occur in the system are registered with their subsequent recording in the log. Errors, warnings and just various notifications are recorded. Based on these records experienced user can correct system operation and eliminate errors. Let's find out how to open the event log in Windows 7.

The event log is stored in a system tool called Event Viewer... Let's see how using different ways you can go to it.

Method 1: "Control Panel"

One of the most common ways to launch the tool described in this article, although far from the easiest and most convenient, is carried out using "Control panels".


Method 2: Run Tool

It is much easier to initiate the activation of the described tool using the tool "Run".


The basic disadvantage of this fast and convenient way is the need to keep in mind the command to call the window.

Method 3: Start Menu Search Box

A very similar method of calling the tool we are studying is carried out using the menu search field "Start".


Method 4: "Command line"

Tool call via Command line rather inconvenient, but such a method exists, and therefore it is also worth a separate mention. First, we need to call the window "Command line".


Method 5: Direct start of the eventvwr.exe file

You can use such an "exotic" option for solving the problem as a direct start of the file from "Explorer"... However, and this way can be useful in practice, for example, if failures have reached such a scale that other options for launching the tool are simply not available. This is extremely rare, but quite possible.

First of all, you need to navigate to the location of the eventvwr.exe file. It is located in the system directory along the following path:

C: \ Windows \ System32


Method 6: Entering the file path in the address bar

With help "Explorer" you can launch the window of interest to us and faster. In this case, you don't even have to look for eventvwr.exe in the directory "System32"... To do this, in the address field "Explorer" you just need to specify the path to this file.


Method 7: Create a shortcut

If you do not want to memorize various commands or transitions to sections "Control panels" if you think it is too inconvenient, but at the same time you often use the magazine, then in this case you can create an icon on "Desktop" or in another place convenient for you. After that, launching the tool Event Viewer will be carried out as simply as possible and without the need to memorize something.


Problems opening the journal

There are cases when problems arise with opening the journal using the above methods. Most often this happens due to the fact that the person in charge of the work this instrument the service is deactivated. When trying to run a tool Event Viewer a message is displayed stating that the event log service is unavailable. Then you need to activate it.

  1. First of all, you need to go to Service Manager... This can be done from the section "Control panels" which is called "Administration"... How to go to it was described in detail when considering Method 1... Once in this section, look for the item "Services"... Click on it.

    IN Service Manager you can go with the tool "Run"... Call it by typing Win + R... Type in the input area:

    Click "OK".

  2. Regardless of whether you have made the transition through "Control Panel" or used command input in the toolbox "Run", starts Service Manager... Look for the element in the list Windows Event Log... To facilitate the search, you can arrange all the objects of the list in alphabetical order by clicking on the field name "Name"... Once the required row is found, take a look at the corresponding value in the column "State"... If the service is enabled, then there should be an inscription "Working"... If it is empty, then this means that the service is deactivated. Also look at the value in the column "Startup type"... In the normal state, there should be an inscription "Automatically"... If there is a value "Disabled" then this means that the service is not activated at system startup.
  3. To fix this, go to the properties of the service by double-clicking on the name Paintwork.
  4. A window opens. Click on the area "Startup type".
  5. Select from the drop-down list "Automatically".
  6. Click on the inscriptions Apply and "OK".
  7. Returning to Service Manager, check Windows Event Log... In the left area of ​​the shell, click on the inscription "Run".
  8. The service has been started. Now in the corresponding column field "State" the value is displayed "Working", and in the column field "Startup type" an inscription will appear "Automatically"... Now the journal can be opened in any of the ways that we described above.

There are quite a few options to activate the event log in Windows 7. Of course, the most convenient and popular ways are to go through "Toolbar", activation by means "Run" or menu search fields "Start"... For convenient access to the described function, you can create an icon on "Desktop"... Sometimes there are problems with starting the window Event Viewer... Then you need to check if the corresponding service is activated.

Windows 7 and Windows 10 constantly monitors the system for any unusual or noteworthy situations, such as a service not running, a device installation, or an app error. All of these situations are called events and are recorded in several different logs.

For example, the Application log stores events related to the operation of applications, both programs of Windows 7 itself and third-party applications, and the System log contains events generated by Windows 7, 10 and components such as device drivers and system services.

How to open the windows event log

To open the event log in windows, click the button Start by entering the string viewing events and pressing the key<Enter>. The picture below shows how it looks Homepage of this snap-in, which displays the log windows events, a list of recently viewed sites and a variety of available actions.

Viewing the Windows Event Log

The pane on the right offers three sections: Custom Views, Windows Logs, and Applications and Services Logs.

The Custom Views section lists all of the event types defined in the current system (which are discussed in more detail a little later). If you perform filtering in any of the event logs or create a new view of events, the new view is saved in this section.

The Windows Logs section displays several subsections, four of which represent the main logs that the system itself maintains.

The Application and System event logs should be checked regularly to identify any existing problems in a timely manner and warn that some problems may appear in the future. The Safety journal is not essential to your daily maintenance routine. You need to look into it only if there is a suspicion of a violation of the computer's security, for example, to find out who is logging on to the system.

The System log records device driver errors, but other tools are available in Windows 7 to make it easier to investigate device problems. For example, Device Manager, which displays an icon for the devices with which there are problems and allows you to view a description of these problems by opening the device property sheets. There is also a utility System information (Msinfo32.exe), which displays information about all hardware problems in the sections System Information> Hardware Resources> Conflict and Sharing and System Information> Components> Problem Devices.

When you select a log, a list of all events available in this log appears in the central window, along with information about the date and time when each event occurred, its source, type (Information, Warning or Error) and other similar information. The main interface changes and new ones are listed below. functionality that appeared in the Event Viewer in Windows snap-in.

  • In the Viewport pane, basic event data is now displayed on the General tab, and additional, more specific information is displayed on the Details tab. This panel can be turned on and off by choosing View Area from the View menu.
  • Event data is now stored in XML format. You can view their schema by selecting the XML Mode radio button on the Details tab, inside the Viewport pane.
  • The Filter command now allows generating XML queries.
  • Clicking on the Create custom view link now allows you to create a new view based on a specific event log, specific event type, event ID, and more.
  • You can now bind tasks to events by clicking first on the event of interest, and then on the Link a task to an event link, and then using the appropriate wizard to create the desired task, which provides for either launching a program or script, or sending e-mail each time this event occurs.
  • Selected events can now be saved in an Event File (.elf) file.

The most common areas of activity, specifically for which specialized software products have been created. 1c 8 online is regulated accounting, trade and warehouse accounting, management accounting and complex solutions

The Applications and Services Logs section lists programs, features, and services that support a standard event logging format, which is new in Windows 7. Previously, logs for all items in this section were stored in separate logs. text files that could not be accessed in older versions of the Event Viewer snap-in except by specifically opening the log file.

This could be a service that does not want to start, a device installation, or an application error. Events are logged and stored in Windows event logs and provide important historical information to help you monitor, keep your system secure, troubleshoot errors, and run diagnostics. It is necessary to regularly analyze the information contained in these logs. You should regularly monitor the event logs and tune the operating system to save important system events. In the event that you are an administrator of Windows servers, then you need to monitor the security of their systems, the normal operation of applications and services, and also check the server for errors that can degrade performance. If you are a user personal computer then you should ensure that the appropriate logs are available to you to support your system and troubleshoot errors.

Event Viewer is a Microsoft Management Console (MMC) snap-in for viewing and managing event logs. It is an indispensable tool for monitoring system health and troubleshooting problems. The Windows service that manages event logging is called Event Log. In the event that it is running, Windows writes important data to the logs. With Event Viewer, you can do the following:

View events of specific logs;
Apply event filters and save them for later use as custom views;
Create and manage event subscriptions;
Assign the execution of specific actions to the occurrence of a specific event.

Launching Event Viewer

You can open Event Viewer in the following ways:
Click on the "Start" button to open the menu, open "Control Panel", select "Administrative Tools" from the list of control panel components and select "Event Viewer" from the list of administrative components;
Open "MMC Management Console". To do this, click on the "Start" button, enter mmc in the search field, and then click on the "Enter" button. An empty MMC will open. From the Console menu, choose Add or Remove Snap-in, or use the keyboard shortcut Ctrl + M. In the "Add / Remove Snap-ins" dialog, select the "Event Viewer" snap-in and click the "Add" button. Then click on the "Finish" button, and after that - the "OK" button;
Use the key combination WIN + R to open the "Run" dialog. In the "Run" dialog box, in the "Open" field, enter eventvwr.msc and click on the "OK" button; (I'll add on my own: What are these troubles for? Just press START-SEARCH and stupidly enter the EVENT LOG in RUSSIAN LETTERS. to the taskbar and see this log.

Event logs in Windows 7

In the Windows 7 operating system, as well as in Windosw Vista, there are two categories of event logs: Windows logs and application and service logs. Windows logs - used by the operating system to record system-wide events related to the operation of applications, system components, security and launch. And application and service logs are used by applications and services to record events related to their operation. You can use the Event Viewer snap-in or the program to manage event logs. command line wevtutil, which will be discussed in the second part of the article. All types of logs are described below:
Application - Stores important events related to a specific application. For example, Exchange Server stores mail forwarding events, including information store events, mailboxes and running services. Placed in% SystemRoot% \ System32 \ Winevt \ Logs \ Application.Evtx by default.

Safety- Stores events related to security, such as logging in / out of the system, using privileges and accessing resources. Placed by default in% SystemRoot% \ System32 \ Winevt \ Logs \ Security.Evtx

Installation- this log records events that occur during the installation and configuration of the operating system and its components. By default, it is located in% SystemRoot% \ System32 \ Winevt \ Logs \ Setup.Evtx.

System- Stores events of the operating system or its components, such as failures when starting services or initializing drivers, system-wide messages and other messages related to the system as a whole. Placed by default in% SystemRoot% \ System32 \ Winevt \ Logs \ System.Evtx

Forwarded events- if event forwarding is configured, this log includes events sent from other servers. Placed in% SystemRoot% \ System32 \ Winevt \ Logs \ ForwardedEvents.Evtx by default

Internet Explorer - this log records events that occur when setting up and working with Internet browser Explorer. Placed by default in% SystemRoot% \ System32 \ Winevt \ Logs \ InternetExplorer.Evtx

Windows PowerShell- This log records PowerShell related events. By default located in% SystemRoot% \ System32 \ Winevt \ Logs \ WindowsPowerShwll.Evtx

Equipment events- if equipment event logging is configured, events generated by devices are recorded in this log. Placed by default in% SystemRoot% \ System32 \ Winevt \ Logs \ HardwareEvent.Evtx

In Windows 7, the infrastructure for providing event logging is based on the same Windows Vista to XML. The data for each event conforms to the XML schema, which allows access to the XML code of any event. In addition, you can create XML-based queries to retrieve data from logs. No XML knowledge is required to use these new features. Event Viewer provides a simple graphical interface to access these features.

Event properties

There are several event properties in the Event Viewer, which are detailed a little below:
The source is the program that logged the event. This can be either the name of a program (for example, "Exchange Server") or the name of a system component or large application (for example, the name of a driver). For example, "Elnkii" stands for EtherLink II driver.

Event ID is a number that identifies a specific type of event. The first line of the description usually contains the name of the event type. For example, 6005 is the ID of the event that occurs when the event logging service starts. Accordingly, at the beginning of the description of this event is the line "The event log service has started". Event ID and Recording Source Name can be used by support team representatives software product for troubleshooting.

Level is the level of importance of the event. In the system and application logs, events can have the following severity levels:

Notification- denotes a change in an application or component, such as the occurrence of an informational event associated with a successful action, the creation of a resource, or the start of a service.
A warning- indicates a general warning of a problem that could affect the service or lead to a more serious problem if left unattended;
Mistake- indicates that a problem has occurred that could affect functions external to the application or component that raised the event.
Critical error- indicates that a failure has occurred, after which the application or component that triggered the event cannot recover automatically;
Success audit- the successful completion of actions that you track through the audit, for example, the use of a privilege;
Failure audit- Unsuccessful execution of actions that you track through the audit, for example, an error while logging in to the system.
User- defines the user account on whose behalf the this event... Users include special entities such as Local Service, Network Service, and Anonymous Logon, as well as real user accounts. This name is the client ID if the event was actually triggered by the server process, or the primary ID if no impersonation is performed. In some cases, the security log entry contains both identifiers. And also in this field can be N / A (N / A), if in this situation Account not applicable. Impersonation occurs when the server allows one process to assign security attributes to another process.

Working code- contains a numeric value that identifies an operation or a point within an operation that triggered this event. For example, initialization or closure.

Journal- the name of the log to which this event was recorded.

Category and tasks- defines the category of the event, sometimes used to further describe the allowed action. Each event source has its own categories. For example, the following categories are: Login / Logout, Privilege Usage, Policy Change, and Account Management.

Keywords is a collection of categories or labels that can be used to filter or search for events. For example: "Network", "Security" or "Resource not found".

Computer- identifies the name of the computer on which the event occurred. Usually this name local computer, but it can also be the name of the computer that forwarded the event, or the name of the local computer before it was changed.

date and time- defines the date and time of occurrence of this event in the log.

Process id- represents the identification number of the process that generated this event. Computer program is only a passive set of instructions, while a process is the direct execution of these instructions

Stream ID- represents the identification number of the thread that generated this event. A process spawned in an operating system can consist of several threads running "in parallel", that is, without a prescribed order in time. For some tasks, this separation can achieve more effective use computer resources

Processor ID- represents the identification number of the processor that handled the event.

Session code is the session identification number on the terminal server on which the event occurred.

Runtime in kernel mode- Determines the time spent executing kernel mode instructions, in units of CPU time. Kernel mode has unrestricted access to system memory and external devices... The kernel of an NT system is called a hybrid kernel or a macrokernel.

Runtime in custom mode- defines the time spent on executing user mode instructions, in units of CPU time. User mode consists of subsystems that pass I / O requests to the appropriate kernel-mode driver through the I / O manager.

Processor load is the time spent executing user mode instructions, in CPU ticks.

Correlation Code - Identifies the action in the process for which the event is being used. This code is used to specify simple relationships between events. Correlation is a statistical relationship of two or more random variables (or quantities that can be considered as such with some acceptable degree of accuracy). Moreover, changes in one or more of these values ​​lead to a systematic change in another or other values.

Relative Correlation ID- defines the relative action in the process for which the event is used

Working with event logs:

View events
To view application log events, follow these steps:
In the console tree, select Windows Logs;
Select the "Applications" log.

It is advisable to review the Application and System event logs as often as possible and examine existing problems and warnings that may portend problems in the future. When you select a log, the middle window displays available events, including event date, time and source, event level, and other data.

The Viewport pane shows basic event data on the General tab, and additional specific data on the Details tab. You can turn this panel on and off by choosing the View menu and then the View Area command.

For critical systems, it is recommended that you keep logs from the last few months. It is usually inconvenient to assign magazines such a size that they can fit all the information in them all the time; this problem can be solved in a different way. You can export logs to files located in a specified folder. To save the selected log do the following:

In the console tree, select the event log that you want to save;
Select the "Save Events As" command from the "Action" menu or select the "Save All Events As" command from the context menu of the log;
In the "Save As" dialog that appears, select the folder where the file should be saved. If you want to save the file in a new folder, you can create it directly from this dialog using context menu or the button " new folder"on the action bar. In the" File type "field, select the desired file format from the available ones: event files - * .evtx, xml file - * .xml, tab-delimited text - * .txt, csv comma-delimited - *. csv. In the "File name" field, enter a name and click on the "Save" button. To cancel saving, click on the "Cancel" button;
If the event log is not intended to be viewed on another computer, in the Display Information dialog box, leave the default option "Do not display information"; "select the option" Display information for the following languages ​​"and click on the" OK "button.

Clearing the event log

Sometimes it is necessary to clear full event logs to ensure effective analysis of warnings and critical operating system errors. To clear the selected log do the following:
In the console tree, select the event log that you want to clear;
Clear the log in one of the following ways:
From the Action menu, select the Clear Log command

On the selected log, right-click to open the context menu. In the context menu, select the "Clear Log" command
Then you can either clear the log, or archive it if it has not been done before:
To clear the event log without saving, click on the "Clear" button;
To clear the event log after saving it, click on the "Save and clear" button. In the "Save As" dialog that appears, select the folder where the file should be saved. If you want to save a file in a new folder, you can create it directly from this dialog using the context menu or the "New folder" button on the action bar. In the "File name" field, enter a name and click on the "Save" button. To cancel saving, click on the "Cancel" button.

Installation maximum size magazine

As mentioned above, event logs are stored as files in the% SystemRoot% \ System32 \ Winevt \ Logs \ folder. By default, the maximum size of these files is limited, but you can change it in the following way:


Select the "Properties" command from the "Action" menu or from the context menu of the selected log

In the "Maximum log size (KB)" field, set the required value using a counter, or set it manually without using a counter. In this case, the value will be rounded to the nearest multiple of 64 KB because the size of the log file must be a multiple of 64 KB and cannot be less than 1024 KB.
Events are saved in a log file that can only grow up to the specified maximum size. After the file reaches its maximum size, the processing of incoming events will be determined by the log retention policy. The following log retention policies are available:
Overwrite events if necessary (old files first) - in this case, new entries continue to be written to the log after it is full. Each new event replaces the oldest in the log;

Archive the journal when full; do not overwrite events - in this case the log file is automatically archived if necessary. No obsolete events are overwritten.

Do not overwrite events (clear log manually) - in this case, the log is cleared manually, not automatically.

To select the required log saving policy, do the following:

In the console tree, select the event log for which you want to resize;
Select the "Properties" command from the "Action" menu or from the context menu of the selected log;
On the "General" tab, in the "When the maximum size is reached" section, select the required parameter and click on the "OK" button.
Analyzing and debugging log activation

Analytical and debug logs are inactive by default. Once activated, they fill up quickly big amount events. For this reason, it is advisable to activate these logs for a limited period of time in order to collect the data necessary for troubleshooting and then disable them again. Logs can be activated as follows:

In the console tree, find and select the analytical or debug log you want to activate;
Select the "Properties" command from the "Action" menu or from the context menu of the selected analytical or debug log;
On the General tab, check the box next to Enable Logging

Opening and Closing a Saved Log

With the Event Viewer snap-in, you can open and view previously saved logs. You can open multiple saved logs at the same time and access them at any time in the console tree. A log opened in Event Viewer can be closed without deleting the information it contains. Follow these steps to open a saved log:

Select the "Open Saved Log" command from the "Action" menu or from the context menu in the console tree;
In the Open Saved Log dialog box, navigate the directory tree, open the folder containing desired file... By default, all event log files are displayed in the dialog box. Also, when opening, you can select the type of files that you want to display in the open dialog. The available file types are event log files (* .evtx, * .evt, * .etl), and event files (* .evtx), old event files (* .evt), or trace log files (* .etl). After the required log file is found, select it by clicking on it with the left mouse button, which will place its name in the line for entering the file name and click on the "Open" button

In the "Open Saved Log" dialog, in the "Name" field, enter a new name that will be used for the log in the console tree. It is only used to represent the log in the console tree and does not change the log file name. You can also use the existing log file name. In the Description field, enter a description for the log. It will be displayed in the center pane when the parent log folder is selected in the console tree;
To create a folder where the saved log will be located, click on the "Create folder" button. In the Name box, enter the name of the folder where the open log will be located, and then click OK. If no parent folder is selected, the new folder will be located in the Saved Logs folder

To make the open event log inaccessible to other users of the computer, you can uncheck the "All users" checkbox. If this check box remains active, the open log will be available to all users, but administrator rights are required to remove it from the console tree;
To open the journal, click on the "OK" button.
To delete the open log from the event tree, do the following:

In the console tree, select the log to be deleted;
Select the "Delete" command from the "Action" menu or from the context menu of the selected log

In the "View Events" dialog, click the "Yes" button.

Conclusion

This part of the article on the Event Viewer snap-in explains about the snap-in itself and details the simplest operations associated with monitoring and maintaining the system using the Event Viewer.

By using the windows 7 or XP event log, most computer problems can be resolved.

It not only logs everything that happens, but also indicates the reasons why the problem occurs.

The only bad thing is that sometimes they are provided in codes and you have to look for the decryption all over the network.

Instructions - where is the windows log

In it we find one word "administration" and click on it.


What should interest you in it. On the left side is the extended menu. In it, opposite the line "Windows logs", click on the small triangle and select the system.

Now you can see all the errors on your computer. It's easy to find them. They are in the upper window, indicated by red dots (circles), less important ones - yellow - these are warnings.

The bottom window indicates the reasons for the problem. Usually, it is impossible for beginners to figure them out on their own.


Therefore, from what is indicated there, formulate a logically correct question and look for the answer in a search engine.

Now, knowing where the windows event log is - many shortcomings (errors, malfunctions), with the right approach you can solve it yourself, in extreme cases, contact the service, indicating to the specialists what is written in the lower window.

Categories: Uncategorized

Hello everyone !!

It is no longer a secret for anyone that in the operating room Windows system SEVEN, just like Windows Vista, there are two categories of event logs: application and service logs, and Windows logs.

Windows Logs - operating system uses to log system-wide events that relate to the operation of system components, applications, security, and startup. Application and service logs - applications and services are used to register events that are related to their work. You can use the Event Viewer snap-in or the wevtutil command-line tool to manage the event logs.
I would like to dwell on how you can work with event logs:
In order to view these very events of the application log, we need to perform the following steps:
Select "Windows Logs" in the console tree.
Select the journal "Applications".
Whenever possible, it is advisable to review the System and Application event logs as often as possible and examine the existing problems and warnings that may predict future problems. In the middle window, when a log is selected, the available events are displayed, including the event date, event level, time and source, and other data.
The Viewport pane displays event data on the General tab, and the Details tab displays additional specific data.

This panel can be turned on and off by choosing the "View" menu and then the "View Area" command.
It is recommended to keep logs for the last few months for critical systems. As a rule, it is not very convenient to assign magazines such a size that they can fit all the information in them, and therefore this problem can be solved in a different way. Logs can be exported to files located in a specified folder. To save the selected log do the following:
Select the event log to be saved in the console tree;
Select the "Save Events As" command from the "Action" menu or select the "Save All Events As" command from the context menu of the log;
In the "Save As" dialog select the folder where the file should be saved. If you need to save a file in a new folder, you can create it directly from this dialog using the context menu or the "New folder" button on the action panel. In the "File type" field, select the desired file format from the available ones: event files - * .evtx, xml file - * .xml, tab-delimited text - * .txt, csv comma-delimited - * .csv. In the "File name" field, enter a name and click on the "Save" button. Click on the "Cancel" button to cancel the save.
If the event log is not intended to be viewed on another computer, leave the default option "Do not display information" in the "Display information" dialog box, and if the log is intended for viewing on another computer, then in the "Display information" dialog box select the option "Display information for the following languages" and click on the "OK" button.
How to work with event logs:
View events
If you want to view application log events, follow these steps:
Select "Windows Logs" in the console tree;
Select the "Applications" log.
It is advisable to review the "System" and "Application" event logs and investigate the existing problems and warnings. When you select a log, the available events are displayed in the middle window.
The Viewport pane will show basic event data on the General tab, and additional data will be displayed on the Details tab. You can turn this panel on and off by choosing the "View" menu and the "View Area" command.
It is recommended for critical systems to keep logs from recent months.

All the time it is inconvenient to assign such a size to the magazines so that all the information can fit in them, as a rule, it is inconvenient to solve this problem in a different way. You can export the logs to files located in the specified folder. To save the selected log follow the steps:
In the console tree, select the event log to be saved;
Select the "Save Events As" command from the "Action" menu or select the "Save All Events As" command from the log menu;
In the "Save As" dialog select the folder in which the file should be saved. If you want to save a file in a new folder, you can create it from this dialog using the context menu or the "New folder" button on the action bar. In the "File type" field, select the desired file format from the proposed ones: event files - * .evtx, tab-delimited text - * .txt,
xml file - * .xml,
csv separated by commas - * .csv. In the "File name" field, enter a name and click on the "Save" button. To cancel saving, click on "Cancel"; If the event log is not intended to be viewed on another computer, in the Display Information dialog box, leave the option "Do not display information" as the default, and if the log is intended for viewing on another computer, then in the Display Information "select the option" Display information for the following languages ​​"and click" OK ".
Clearing the event log
Select the event log in the console tree to be cleared; Clear the log in one of the following ways:
From the Action menu, choose the Clear Log command
On the selected log, right-click to open the context menu. In the context menu, select the "Clear Log" command
Next, you can clear the log or archive it in case this has not been done before:
If you clear the event log without saving, click on the "Clear" button;
To clear the event log after saving it, click on "Save and clear". In the "Save As" dialog select the folder where the file should be saved. If you want to save a file in a new folder, you can create it from this dialog using the context menu or the "New folder" button on the action panel. In the "File name" field, enter a name and click on "Save". To cancel saving, press "Cancel". Uh, like everything, but if it's not clear then I'm waiting for your comments.

That's all and see you again ...