Event Viewer
DataCenter, Desktops, DHCP, DNS, Management, Microsoft Office, Microsoft Windows, Network management software, Network monitoring, Networking, Networking services, OS, Performance management, Remote management, Security, Servers, SQL Server, TCP, Tech support
howdy folks,
If I create a new log view in event viewer and filter the results, is there any way to save this view?
Everytime I close event viewer I have to re-create it.
Probably just MS by design....
Is there any way to script it?
Software/Hardware used:
Software/Hardware used:
ASKED:
September 28, 2006 10:54 AM
UPDATED:
June 1, 2010 8:34 PM
Answer Wiki:
When you close the Event Viewer console, any filter you have set is lost. The next time you open the Event Viewer, you see all default events. However, you can create your own Event Viewer console to retain a filter from session to session.
Follow these steps to create the console:
Go to Start | Run and type MMC to open the MMC console.
Choose Console | Add/Remove Snap-in. Select Add | Event Viewer | Add and then click Finish, Close, and OK.
With the Event Viewer open in the console, open an Event Log and set the desired filter.
Repeat step 3 for other logs as desired.
Close the console and when prompted, click Yes to save the console. Specify a name such as Filtered_Events.msc and click Save. Windows Server by default will save the file in the Administrative Tools folder unless you specify otherwise. I saved mine to the desktop and named it "Filtered Event Viewer."
To test your new filtered Event Viewer, open the Filtered_Events console and review the contents of the filtered event logs. The console should save the filter changes each time you close it.
To see all answers submitted to the Answer Wiki: View Answer History.
Hey P-man
Thanks for the reply.
I may not have been clear in my question….or I may not understand your answer.
Here is the nitty gritty of what I am asking:
When I check our server, I want to see only the NTBackup events.
I can do this by filtering, but I have to set the filters everytime I re-open event viewer.
What I am asking- is there any way to save a “view” so that opens with the filters in place rather than just save the log file.
You can’t save the view in event viewer. What you can do is use MS’s log parser tool — http://www.microsoft.com/downloads/details.aspx?FamilyID=890cd06b-abf8-4c25-91b2-f8d975cf8c07&DisplayLang=en
The tool when installed on a server or client computer allows you to use vbscript to get information into and out of all sorts of log files and do work in it.
This is what you will want to do with your issue.
Good luck
James
You can’t save the view in event viewer. What you can do is use MS’s log parser tool — http://www.microsoft.com/downloads/details.aspx?FamilyID=890cd06b-abf8-4c25-91b2-f8d975cf8c07&DisplayLang=en
The tool when installed on a server or client computer allows you to use vbscript to get information into and out of all sorts of log files and do work in it.
This is what you will want to do with your issue.
Good luck
James
Honestly, there IS a way to save the that view and many others as well if you want in an .msc file. Here’s how you do it:
Startup the microsoft management console, startmenu –> run –> mmc.exe, in the file menu you select the ‘add/remove snap-in’ option. On the folowing screen you press the ‘add’ button, and in the list that is shown you select the event viewer. Next question will be if you want it to work for the local machine or a network computer. When you’re done click ok until you see the event viewer. Now all you do is apply the filter the way you want it to be and use file –> Save as..
Don’t know if my last post made it here…I think there was a problem, but just wanted to say thanks to all who posted.
Vinceke’s solution is perfect.
You can add as many computers as you want, and then filter as many views for each one as you like, and save them all in ONE .msc file. Create a shortcut and voila.
Jolly good show Vinceke……jolly good.