New
#821
In event viewer, right click on "Custom Views" and select "Create custom view".
Select "by log" and tick "Windows logs" in the drop down.
Enter 258 for the event ID.
Click OK to save it. Give it a name (I called it 258) and then you'll see the new filter you defined under custom views.
If you don't have any 258 then it isn't running (unless you cleared your event logs I guess).
Sorry to be off topic.