Understanding Views

When Event Viewer is opened, the Overview And Summary screen is displayed, which summarizes all events across all Windows Logs. The total number of events for each type that have occurred are displayed, with additional columns that display the number of events of each type that have occurred over the last seven days, the last 24 hours, or the last hour. Clicking on the + (plus) sign allows you to browse to each event type and display the Event ID, Source, and Log in which the event occurred. Double-clicking a specific event summary takes you directly to that event in the log and automatically creates a filtered view showing all individual events with that event source and event ID, which can be accessed from the left pane.

You can configure persistent event filters by using the Custom Views node in Event Viewer. You can create views automatically by double-clicking events in the summary view, or you can create views manually. A built-in custom view named Administrative Events shows all events on the system that may require administrative action by filtering errors and warnings across all admin logs on the system.

To create a view (filter) manually, follow these steps:

1. Right-click Custom Views and then select Create Custom View.
2. In the Create Custom View dialog box, shown here, enter the criteria for which you want events displayed.
   
   
   You can also click the XML tab and enter the XML filter directly. This may be useful if you are creating an advanced query for which the graphical user interface (GUI) options in the Filter tab are insufficient. Note that when you have edited a filter in the XML tab, you cannot return to the Filter tab for that filter.
3. Select the fields used to filter events using the following criteria:
   • By Log If you are filtering by log, first select the logs you are interested in. The Event Logs drop-down list adjusts to the list of logs relevant for those sources.
   • By Source If you are filtering by source, pick the sources of interest first. The Sources drop-down list adjusts to just the sources available in those logs.
   • Logged Last Hour, Last 12 Hours, Last 24 Hours, Last 7 Days, or Last 30 Days. Selecting Custom Range brings up the Custom Range dialog box, allowing you to select a much more specific date range, including when events start and when they stop.
   • Event Level Select Critical, Warning, Verbose, Error, or Information.
   • Event Logs Click the drop-down arrow to open the Event Log Selection window. Select the event log or event logs that you want to include in the view.
   • Event Sources Click the drop-down arrow to display a list of available sources for the selected log so that you can specify which event source(s) to include in the view. In some cases, certain sources may not be listed (usually this can happen for event sources from older versions of Windows), in which case you can type in the source name manually.
   • Include/Exclude Event IDs Enter Event ID numbers or ranges to be included or excluded, separated by commas. To exclude a number, include a minus sign in front of it. For example, typing 1,3,5-99,-76 will include event IDs 1, 3, 5 through 99 and exclude 76.
   • Task Category Select a task category to filter for events that specify that task category.
   • Keywords Enter keywords to be included in the filter.
   • User Enter the user name by which to filter the events.
   • Computer Enter the computer name by which to filter events. This will likely be used when filtering saved logs from other computers or when filtering events forwarded from several computers on to a centralized log.
4. Click OK, name the view, and then select where the view will be saved. Create a new folder, if needed, to better categorize custom views you create for various purposes. By default, custom views defined on a computer will be available to all users on that computer. To define a custom view private to the current user, clear the All Users check box before saving the view. Custom views are saved and you may reuse them any time you run Event Viewer in the future. Furthermore, you can also export custom views into an XML file at a specified location or imported from an XML file. This allows administrators to share interesting event views by exporting them to a shared location and importing into various Event Viewer consoles as needed.