13

I've got a specific "Task category" of Windows log events I'd like to see on their own, but the option to filter by category in the "Filter Current Log" dialog is disabled/greyed out. How can I use it?

2 Answers 2

15

The "Task category" is only available to filter a log once you've already selected something for "Event sources" above that in the "Filter Current Log" dialog. Note that in every case I've checked, you can only have one "Event sources" selected, or "Task category" gets disabled again.

That said, for the category you want filter for, first figure out what the source is, select it, and then select the task category.

After some hunting, I had finally found the answer to this here and thought I'd share: https://social.technet.microsoft.com/forums/windowsserver/en-US/c5bafdd9-2e70-4ba5-ab0b-018e86adbc97/filtering-2008-r2-event-log-security

2
  • In my case, I´ve already selected a source, and still can´t select any category!
    – Daniel
    Oct 20, 2017 at 18:14
  • FYI, you can find the correct event source by finding an event which has the task category you want to filter on, and looking at the source field at the bottom of the event details pane. It seems that the field is truncated, to about 20 characters.
    – jpaugh
    Aug 6, 2018 at 19:27
2

I´m adding this answer because I also couldn't filter. So you need to manually edit the xml. Enter in Edit your Custom View Properties. than go to the tab XML and hit the checkbox "Edit query manually"

you will have something like these:

<QueryList>
  <Query Id="0" Path="Application">
    <Select Path="Application">*[System[Provider[@Name='quem ME atende'] and (Level=1 or Level=2 or Level=3 or Level=4 or Level=0 or Level=5)]]</Select>
  </Query>
</QueryList>

So you need to add another Filter (Level is already added, Warning, Error etc) So add "and (Task=12)" Where 12 is number of your category!

<QueryList>
  <Query Id="0" Path="Application">
    <Select Path="Application">*[System[Provider[@Name='quem ME atende'] and (Level=1 or Level=2 or Level=3 or Level=4 or Level=0 or Level=5) and (Task=12)]]</Select>
  </Query>
</QueryList>

And here you go, you may have to refresh the View more than once, as it is tricky!

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .