Event Viewer stopped showing new events

I went to Event Viewer to check Event 100 - Boot Duration.

But there are no events listed for the past several weeks even though I’ve rebooted many times during that time. At the top it said Number of events: 75, and newer ones available (or similar wording).

I clicked the Refresh button in the right column and this added one new event - the latest event 100. But no Event 200 showing the system was shut down. I’ve done several cold reboots in the last few minutes so there should be many new entries but that’s not the case.

In the right column under Operational > Properties, “Overwrite events as needed" is checked.

Any idea why new events are not displayed?

Are you having issues with your system that make you look into event viewer? Is your system crashing or other abnormal Disruptions? If not, forget about the event viewer if everything is running as normal.

Mike,

I could not make out from your remarks whether other events, non-100 non-200 ones, are being logged or not.

I suggest that you try to find out of the problem is with events being logged or with Event viewer displaying them.
Does this show your expected events?
NirSoft FullEventLogView

What are the Log & Source names for these 100, 200 events?
I monitor shutdowns & startups in my Event viewer, Custom views but do not use the events you mention.

I understand the point Lance is making & I often say the same myself but, on this occasion, I think you are correct in wanting to resolve the problem.


All the best,
Denis

I think you might not be looking at all the relevant entries, some of which seem to me to be alternative events to 100.
- My own logs sometimes show 100 but sometimes 101, 203
- Are they appearing in your logs instead?

I normally monitor other events for startup & shutdown. Never having noticed your Performance Monitoring events before - 100, 200, [101, 108], I will try to incorporate them in my Startup, Shutdown Custom view definition later today.
- If you want, I'll post my amended Custom view definition for you.
- Do you know how to import a Custom view or will I need to explain that?

All the best,
Denis

Mike,

Here is a zipped copy of my Event viewer, Custom view definition for Power - Starts, shutdowns.
It includes the events I had previously been monitoring as well as those you have been looking at.
Start events - 12, 6005, [100, 101 - which do not occur every time] I've also noticed that EventID 100 is often delayed by up to two minutes - Event viewer can also be manually refreshed from the Action menu.
Shutdown events - 1074, 6006, [200, 203 - which do not occur every time]
Power - Starts, shutdowns.zip

Here is my guide to importing an Event viewer, Custom view definition.
Import Event viewer, Custom views - (Power state transitions) - my post #4 - TenForums
The procedure is the same for all Custom view imports. I realise that you might not be interested in the particular example Custom view given there.


All the best,
Denis

Mike,

I have no event 102 entries at all.
I read Event ID 102 - Provider configuration - MSLearn but am none the wiser.

I never clear the logs myself. I let Windows manage them. I rely on Custom views to allow me to see things of current interest.

Denis