1

I know you can create default filters for your local event logs. When I support customers I often receive an .evt file that I have to look through. I begin every search by going to filter, scrolling to my desired sources, and then beginning to look for issues.

I'm looking for a way to create a default filter that applies to all event logs, even external .evt files that you just open temporarily. How can I do this?

1

There are several workarounds that may help you

  1. Create your default filter for one DEFAULT log file and then, when you need to check your new log file, just rename it to this DEFAULT file name.

  2. If renaming not possible make a text document which lists your desired filters as an XPath queries. It will be your filter library.
    E.g. *[System[Provider[@Name='Application Error' or @Name='Application Hang']]]
    After log opening, go to Filter, then switch to XML, click Edit query manually and modify XML query - replace * with the XPath.
    For complex filters, it should work faster than using UI

  3. A better option - try Event Log Explorer (free for noncommercial use). It lets you set predefined filters for all online logs and log files at once.

  • Not sure I understand how the default view filter would work. I can create filters for the default views, but changing the name of a saved log doesn't change the filter even with the default filter created. If I have to modify the XML query every time I could simply use the filter drop down and select the sources I want so I don't save time on that. The Event Log Explorer was a good call though, thank you for that! I will be sure to check it out :) – MagneTism Mar 21 '18 at 6:07
  • Unfortunately it won't work with the views (if you mean Custom views). It will work only with the log files (under Saved logs). So you should have a dummy (default) log file with a filter and then rename other files into it. Not a very good solution anyway. – Michael Karsyan Mar 22 '18 at 17:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.