Windows 10: Event Viewer - Filter by Drive

Hi everyone, I would like to see what automated stuff happens on my PC's secondary SATA HDD. More specifically, I would like to see which Scheduled Tasks involve the secondary drive. I know it's possible to log events in Event Viewer under "Application and services logs\Microsoft\Windows\TaskScheduler\Operational", but is it possible to set a filter to see only events targeting the secondary drive or something similar?Thanks to anyone who will help :

:)

 

Event Viewer: Filter Administrative Events?

Martin,

You will think this is not what you want to do but please bear with me for a few moments and you'll see that it does resolve your Custom view problem.

1 Right click on the Custom view, Administrative Events entry then select Export Custom view. Export it to any convenient location and use any old name for it.
2 On the right-hand side of the Event viewer window, click on Import current view then select the exported file.
3 In the Import Custom view file dialog that pops up, give it a slightly different name such as Administrative Events - Tailored. The name you choose is not significant but is merely how it will be listed in the Custom views and my suggested name will keep it next to the original entry [after you later re-open Event viewer rather than straightaway].

4 Select your new Custom view, click on Filter Current Custom view and the filter dialog will appear without any greyed out entries. It will be a fully functional filter allowing you to make temporary changes to the Custom view.



5 You can also make permanent changes to the new Custom view. Right-click on it, select Properties, click on Edit filter then make the changes on the dialog that appears or in the xml tab.



So this will achieve the filtered Custom view that you want even though it's not quite what you asked for.

All the best,
Denis

 

Win 10 Event Viewer -- cannot save filter in Custom Views

I try to keep up a custom view for the Event Viewer. Since Win 10 was upgraded I can add exclusions such as ...-1234,-567,-89... but these are not saved upon exit from Event Viewer. Many repeated events are reported and most are not important.

Nor can I find where the filter data is stored: registry, sys32, etc.

Steps: Launch Event Viewer -- find one or more events in the custom view log -- launch Filter Current Custom View -- Add the events to be filtered out (including a (-)minus sign and comma separation. (note that in the current session, the events are
removed as is expected) -- close the Filter Current Custom View (note that there is no Apply button) -- close and restart Event Viewer.

Results: added event filter numbers are removed from the filter list -- any filter brought over from Win 8 upgrade still remain.

Fixing this would be great. Knowing where the data is stored would also be fine.

 

Event Viewer: Filter Administrative Events?

The Administrative Events window quickly fills up with DistributedCOM warnings and errors. I tried to fix this, but in the end, couldn't get past the final step:

Fixing DistributedCOM error 10016

Failing that (any other ideas folks on how to fix rather than hide the errors??), I would at least like to filter out all event IDs 10010 and 10016: there are so many after a few weeks that it's hard to navigate through the mass of them to find other information. I should be able to go to Administrative Events and in Actions choose 'Filter Current Custom View'. But everything is greyed out (nothing at all is clickable) in the 'Filter Current Custom View' window, even though I log into Event Viewer as Administrator.

How do I proceed in order to filter those events from Administrative Events?

(Creating a new custom filter is not what I want to do BTW, and in any case (having tried it), setting -10010,-10016 as the filter removes a whole lot of other events present in Administrative Events, for some reason).

Thank you.

Windows 10 Pro 18363.1379