Event Viewer: Filter Administrative Events?  

Page 1 of 2 12 LastLast

  1. Posts : 258
    Windows 10 (Home Ed.)
       #1

    Event Viewer: Filter Administrative Events?


    The Administrative Events window quickly fills up with DistributedCOM warnings and errors. I tried to fix this, but in the end, couldn't get past the final step:

    Fixing DistributedCOM error 10016

    Failing that (any other ideas folks on how to fix rather than hide the errors??), I would at least like to filter out all event IDs 10010 and 10016: there are so many after a few weeks that it's hard to navigate through the mass of them to find other information. I should be able to go to Administrative Events and in Actions choose 'Filter Current Custom View'. But everything is greyed out (nothing at all is clickable) in the 'Filter Current Custom View' window, even though I log into Event Viewer as Administrator.

    How do I proceed in order to filter those events from Administrative Events?

    (Creating a new custom filter is not what I want to do BTW, and in any case (having tried it), setting -10010,-10016 as the filter removes a whole lot of other events present in Administrative Events, for some reason).

    Thank you.

    Windows 10 Pro 18363.1379
      My Computers


  2. Posts : 294
    Windows 10 Home
       #2

    martinlest said:
    The Administrative Events window quickly fills up with DistributedCOM warnings and errors. I tried to fix this, but in the end, couldn't get past the final step:
    Fixing DistributedCOM error 10016

    Failing that (any other ideas folks on how to fix rather than hide the errors??), I would at least like to filter out all event IDs 10010 and 10016: there are so many after a few weeks that it's hard to navigate through the mass of them to find other information. I should be able to go to Administrative Events and in Actions choose 'Filter Current Custom View'. But everything is greyed out (nothing at all is clickable) in the 'Filter Current Custom View' window, even though I log into Event Viewer as Administrator.

    How do I proceed in order to filter those events from Administrative Events?

    (Creating a new custom filter is not what I want to do BTW, and in any case (having tried it), setting -10010,-10016 as the filter removes a whole lot of other events present in Administrative Events, for some reason).

    Thank you.

    Windows 10 Pro 18363.1379
    Hi. This is an ongoing issue for a very long time. I tried to fix it once by making take ownership changes but ultimately caused major problems. Fortunately I had a Macrium Reflect backup image to restore the system. The only thing that MS did was change them from errors to warnings. Myself and I think many others have just learned to live with these warnings as they do not cause any problems at all.
      My Computer


  3. Posts : 30,321
    10 Home x64 (22H2) (10 Pro on 2nd pc)
       #3

    @martinlest, see this post for why the errors don't matter, and a link to detailed instructions in the note from MS as to how to edit the XML query if you don't want to see them...

    Why Certain DCOM 10016 Events Don't Matter
      My Computers


  4. Posts : 16,194
    Windows 10 Home x64 Version 22H2 Build 19045.3693
       #4

    Make customisable Event viewer, Custom view, Administrative Events


    martinlest said:
    Creating a new custom filter is not what I want to do BTW ...
    Martin,

    You will think this is not what you want to do but please bear with me for a few moments and you'll see that it does resolve your Custom view problem.

    1 Right click on the Custom view, Administrative Events entry then select Export Custom view. Export it to any convenient location and use any old name for it.
    2 On the right-hand side of the Event viewer window, click on Import current view then select the exported file.
    3 In the Import Custom view file dialog that pops up, give it a slightly different name such as Administrative Events - Tailored. The name you choose is not significant but is merely how it will be listed in the Custom views and my suggested name will keep it next to the original entry [after you later re-open Event viewer rather than straightaway].

    4 Select your new Custom view, click on Filter Current Custom view and the filter dialog will appear without any greyed out entries. It will be a fully functional filter allowing you to make temporary changes to the Custom view.
    Event Viewer: Filter Administrative Events?-filter-current-custom-view.png

    5 You can also make permanent changes to the new Custom view. Right-click on it, select Properties, click on Edit filter then make the changes on the dialog that appears or in the xml tab.


    So this will achieve the filtered Custom view that you want even though it's not quite what you asked for.

    All the best,
    Denis
    Last edited by Try3; 20 Feb 2021 at 02:56.
      My Computer


  5. Posts : 258
    Windows 10 (Home Ed.)
    Thread Starter
       #5

    Thanks, I'll look at those options and post back.

    I am OK with the events remaining unfixed, especially as it sounds risky to try to eliminate them: as I say, their only inconvenience to me is how they take over the Event Viewer log after a while and make it harder to navigate. Not a 'deal breaker' of course but it'd be good to have them excluded from the log.
      My Computers


  6. Posts : 16,194
    Windows 10 Home x64 Version 22H2 Build 19045.3693
       #6

    martinlest said:
    I am OK with the events remaining unfixed, especially as it sounds risky to try to eliminate them: as I say, their only inconvenience to me is how they take over the Event Viewer log after a while and make it harder to navigate. Not a 'deal breaker' of course but it'd be good to have them excluded from the log.
    Martin,

    I've added para 5 to my last post to show how you can make permanent changes to its definition if you choose to do so - use of Filter Current Custom view [para 4] just changes it temporarily.
    Try3 said:
    4 Select your new Custom view, click on Filter Current Custom view and the filter dialog will appear without any greyed out entries. It will be a fully functional filter.
    5 You can also make permanent changes to the new Custom view. Right-click on it, select Properties, click on Edit filter then make the changes on the dialog that appears or in the xml tab.
    Denis
      My Computer


  7. Posts : 258
    Windows 10 (Home Ed.)
    Thread Starter
       #7

    That seemed to work fine, thank you. I got similar dialogues to when I created a custom filter earlier, but when I did that I got an error message at the end and EV crashed... I can't recall exactly what happened to give further details I'm afraid.

    The only bit I don't see is in your para#5: "... then make the changes on the dialog that appears or in the xml tab." What dialogue list is supposed to appear and (as none does) what do I change in the XML tab?
      My Computers


  8. Posts : 16,194
    Windows 10 Home x64 Version 22H2 Build 19045.3693
       #8

    martinlest said:
    The only bit I don't see is in your para#5: "... then make the changes on the dialog that appears or in the xml tab." What dialogue list is supposed to appear and (as none does) what do I change in the XML tab?
    Try3 said:
    5 You can also make permanent changes to the new Custom view. Right-click on it, select Properties, click on Edit filter then make the changes on the dialog that appears or in the xml tab.

    Event Viewer: Filter Administrative Events?-properties-edit-filter.png

    Denis
      My Computer


  9. Posts : 40,988
    windows 10 professional version 1607 build 14393.969 64 bit
       #9

    As posted by Bree many / most dcom events can be ignored.

    The opening post displayed application events.
    Most often these are system events.

    Code:
    Event[458]:
      Log Name: System
      Source: Microsoft-Windows-DistributedCOM
      Date: 2020-11-14T05:03:12.008
      Event ID: 10010
      Task: N/A
      Level: Error
      Opcode: Info
      Keyword: Classic
      User: S-1-5-21-163296743-1907596348-653451803-1001
      User Name: DESKTOP-9HEBUKS\aaaaaaaa
      Computer: DESKTOP-9HEBUKS
      Description: 
    The server {9BA05972-F6A8-11CF-A442-00A0C90A8F39} did not register with DCOM within the required timeout.
      My Computer


  10. Posts : 258
    Windows 10 (Home Ed.)
    Thread Starter
       #10

    Denis... thanks but I am none the wiser. You're right - I do need to make this permanent - as you said, the new custom view is filling up with DCOM events (so I have deleted it and will make a new one, once I understand how to make the filter 'stick')..

    I've followed your paragraph 5 and I get the boxes open as per your last screenshots. But with those windows open you say "then make the changes on the dialog that appears or in the xml tab". I go to the XML tab, but what 'dialogue' do you mean and what 'changes' do I make? I just have the Custom View Properties window open.. I don't know what to do with it so that the DCOM events are filtered out permanently. Could you kindly specify...

    Thank you.
    Last edited by martinlest; 20 Feb 2021 at 04:19.
      My Computers


 

  Related Discussions
Our Sites
Site Links
About Us
Windows 10 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 10" and related materials are trademarks of Microsoft Corp.

Designer Media Ltd
All times are GMT -5. The time now is 09:49.
Find Us




Windows 10 Forums