Event Viewer: Filter Administrative Events?

Try3 · 20 Feb 2021

Martin,

dialog = dialog box = the onscreen box you see

The initial display of this is as shown in my post #8 but you can click on the xml tab to work in xml instead if you prefer.

You make whatever changes you want. Your initial post indicated that you wanted to add
-10016,-10010
to the EventID input box where it currently shows <All Event IDs>.

By the way, I have counted the lists made using this filter and it certainly seems to operate as it should -
no filter :18777 Events listed
10010,10016 : 962 Events listed
-10010,-10016 : 17815 Events listed

Denis

martinlest · 20 Feb 2021

Right, I think we were at crossed purposes! Have done all that and I'll check and see what information it now logs (i.e. filters).

Thank you very much for the help. (I'll post back here if it doesn't work - but sounds as if it will, from what you say).

Martin

Try3 · 20 Feb 2021

Martin,

Glad it's progressed.

By the way, I have counted the lists made using this filter and it certainly seems to operate as it should -

no filter :18777 Events listed
10010,10016 : 962 Events listed
-10010,-10016 : 17815 Events listed

I also use NirSoft's MyEventViewer sometimes.
- There's a guide at How to Create Your Own Windows Event Log Notification System - HTG
- I find this useful if I know what time [or very short time period] I want to look at but do not yet know what Events I'm interested in.

I have just this moment seen this on the NirSoft's MyEventViewer page - FullEventLogView utility I have not yet experimented with it.

Denis