When you close the Event Viewer console, any filter you have set is lost. The next time you open the Event Viewer, you see all default events. However, you can create your own Event Viewer console to retain a filter from session to session.
Follow these steps to create the console:
Go to Start | Run and type MMC to open the MMC console.
Choose Console | Add/Remove Snap-in. Select Add | Event Viewer | Add and then click Finish, Close, and OK.
With the Event Viewer open in the console, open an Event Log and set the desired filter.
Repeat step 3 for other logs as desired.
Close the console and when prompted, click Yes to save the console. Specify a name such as Filtered_Events.msc and click Save. Windows Server by default will save the file in the Administrative Tools folder unless you specify otherwise. I saved mine to the desktop and named it “Filtered Event Viewer.”
To test your new filtered Event Viewer, open the Filtered_Events console and review the contents of the filtered event logs. The console should save the filter changes each time you close it.