Windows 10: Event Viewer limit number of entries

I have a shortcut to open Event Viewer directly to System. Only need to see the most recent 100 entries. How can I limit the number?

:)

 

Windows 10 File Explorer not working

Have you tried using Event Viewer? Try to open File Explorer, note the time you try to open it, and then look for an event under Event Viewer "applications". There should be an event for that time plus an "information" entry.

 

error entries on Event Viewer

Hi,

As you know most of the error messages in the Event viewer can be safely ignored, if you are not facing any serious issues. However if you notice any performance related issues, then you can refer those error messages to find the exact cause.

For hard disk drives I suggest you to optimize the drives of your PC by following the steps below and check if the space of the drives will be reduced.

• 
  Open File Explorer by pressing Windows logo + E keys on the keyboard.
  
• 
  From the left side panel click on This PC and open Properties by right-clicking on SSD.
  
• 
  Click on Tools tab and select Optimize under Optimize and defragment drive.
  
• 
  You can also analyze the drive by click on the Analyze option from the same window.
  

For Internet Explorer you can Reset Internet Explorer.

• 
  Press Windows key + R, type inetcpl.cpl and press Enter.
  
• 
  Go to Advanced tab.
  
• 
  Click on Reset and OK.
  

Note: Please note that running Reset Internet Explorer Settings will reset all user-defined settings including those set by installed extensions, toolbars and other add-ons to
IE Defaults. This includes all Security, Privacy and Zone settings. Also this will clear browsing history, delete all temporary Internet Files, cookies, form data and especially all stored passwords.

It’s not a good idea to uninstall the latest Windows Update as they have a lot of security patches. As you know drivers have to be provided by manufacturer, you can go and install the latest drivers offered from the manufacturer’s website.

Hope this information is helpful.

 

Would limiting it by time be OK? You could make a custom view selecting the last hour (or day), save it somewhere (right click and export) and then make a shortcut eventvwr /vath_to_saved_XML_file

Alternatively if you want the last 100 specifically you can get them in powershell Code: get-eventlog -logname system -newest 100[/quote] You could then send the output to a file or whatever you wanted.

 

Splendid. Thank you.

. . . Tried both, custom view works for me. Apparently EV does not remember the the view so I need to click it when I open EV. Can I include the view in my shortcut?
Code: C:\Windows\System32\winevt\Logs\System.evtx[/quote]

 

That is strange - it remembers the view for me. Even if I change to another view when I close EV and re-open using shortcut it jumps back to the defined custom view.

How did you make the shortcut?

This is mine:





And this is the XML from exporting the custom view (I stored it in C:\Temp\SystemLastHour.xml): PHP Code: <ViewerConfig><QueryConfig><QueryParams><Simple><Channel>System</Channel><RelativeTimeInfo>1</RelativeTimeInfo><Level>1,2,3,4,0</Level><BySource>False</BySource></Simple></QueryParams><QueryNode><Name>SystemLastHour</Name><QueryList><Query Id="0" Path="System"><Select Path="System">*[System[(Level=1 or Level=2 or Level=3 or Level=4 or Level=0) and TimeCreated[timediff(@SystemTime) &lt;= 3600000]]]</Select></Query></QueryList></QueryNode></QueryConfig></ViewerConfig>

 

OK, my saved xml is considerably longer:

Code: <ViewerConfig><QueryConfig><QueryParams><Simple><Channel>file://C:\WINDOWS\System32\Winevt\Logs\System.evtx</Channel><RelativeTimeInfo>3</RelativeTimeInfo><BySource>False</BySource></Simple></QueryParams><QueryNode><Name LanguageNeutralValue="24hr">24hr</Name><QueryList><Query Id="0" Path="file://C:\WINDOWS\System32\Winevt\Logs\System.evtx"><Select Path="file://C:\WINDOWS\System32\Winevt\Logs\System.evtx">*[System[TimeCreated[timediff(@SystemTime) &lt;= 86400000]]]</Select></Query></QueryList></QueryNode></QueryConfig><ResultsConfig><Columns><Column Name="Level" Type="System.String" Path="Event/System/Level" Visible="">116</Column><Column Name="Keywords" Type="System.String" Path="Event/System/Keywords">70</Column><Column Name="Date and Time" Type="System.DateTime" Path="Event/System/TimeCreated/@SystemTime" Visible="">166</Column><Column Name="Source" Type="System.String" Path="Event/System/Provider/@Name" Visible="">76</Column><Column Name="Event ID" Type="System.UInt32" Path="Event/System/EventID" Visible="">76</Column><Column Name="Task Category" Type="System.String" Path="Event/System/Task" Visible="">80</Column><Column Name="User" Type="System.String" Path="Event/System/Security/@UserID">50</Column><Column Name="Operational Code" Type="System.String" Path="Event/System/Opcode">110</Column><Column Name="Log" Type="System.String" Path="Event/System/Channel">80</Column><Column Name="Computer" Type="System.String" Path="Event/System/Computer">170</Column><Column Name="Process ID" Type="System.UInt32" Path="Event/System/Execution/@ProcessID">70</Column><Column Name="Thread ID" Type="System.UInt32" Path="Event/System/Execution/@ThreadID">70</Column><Column Name="Processor ID" Type="System.UInt32" Path="Event/System/Execution/@ProcessorID">90</Column><Column Name="Session ID" Type="System.UInt32" Path="Event/System/Execution/@SessionID">70</Column><Column Name="Kernel Time" Type="System.UInt32" Path="Event/System/Execution/@KernelTime">80</Column><Column Name="User Time" Type="System.UInt32" Path="Event/System/Execution/@UserTime">70</Column><Column Name="Processor Time" Type="System.UInt32" Path="Event/System/Execution/@ProcessorTime">100</Column><Column Name="Correlation Id" Type="System.Guid" Path="Event/System/Correlation/@ActivityID">85</Column><Column Name="Relative Correlation Id" Type="System.Guid" Path="Event/System/Correlation/@RelatedActivityID">140</Column><Column Name="Event Source Name" Type="System.String" Path="Event/System/Provider/@EventSourceName">140</Column></Columns></ResultsConfig></ViewerConfig>[/quote] I note that your shortcut calls the xml while mine calls Winevt. I'll try your way . . .

 

Hmmm - I didn't write the xml - just made a custom view (selecting system for last hour) and exported it with right click, export custom view.

It is interesting yours is more complex right from the top - yours says:
<Channel>file://C:\WINDOWS\System32\Winevt\Logs\System.evtx</Channel>
and mine is
<Channel>System</Channel>

You could save the xml in my post above, make a shortcut using that and see if that works for you. There is no system specific info in it.

I've no idea why it is generated differently let alone how to edit it manually.

 

Success. My Shortcut: C:\Windows\System32\eventvwr.exe /v:"c:\all\Bobs\Documents\EventViewer24HrView.xml"

Thanks again.

 

You are welcome - I learned something today too *Smile