Windows 10: I need to filter Bsod events/system crashes data using event viewer. What should I do?

Requirement:- I need to fetch system crasheskernel level crash in which your machine restarts or basically just crashes. I found the best way to be filtering through event viewer events. For that I found as of now, the best way to approach is filter usingLogName : System,EventId: 6008, 41, 1001, Level:1,2Error, CriticalDo you suggest anything else?Also, I found Id's 1003 and 101 also reporting BSOD causes, but not everytime. Such as they report small issues with DHCP client and clock respectively.Refer the links:-1 https://answers.microsoft.com/en-us/windows/forum/all/error-id-1003-your-c

:)

 

Win 10 Event Viewer -- cannot save filter in Custom Views

I try to keep up a custom view for the Event Viewer. Since Win 10 was upgraded I can add exclusions such as ...-1234,-567,-89... but these are not saved upon exit from Event Viewer. Many repeated events are reported and most are not important.

Nor can I find where the filter data is stored: registry, sys32, etc.

Steps: Launch Event Viewer -- find one or more events in the custom view log -- launch Filter Current Custom View -- Add the events to be filtered out (including a (-)minus sign and comma separation. (note that in the current session, the events are
removed as is expected) -- close the Filter Current Custom View (note that there is no Apply button) -- close and restart Event Viewer.

Results: added event filter numbers are removed from the filter list -- any filter brought over from Win 8 upgrade still remain.

Fixing this would be great. Knowing where the data is stored would also be fine.

 

Event Viewer: Filter Administrative Events?

Martin,

You will think this is not what you want to do but please bear with me for a few moments and you'll see that it does resolve your Custom view problem.

1 Right click on the Custom view, Administrative Events entry then select Export Custom view. Export it to any convenient location and use any old name for it.
2 On the right-hand side of the Event viewer window, click on Import current view then select the exported file.
3 In the Import Custom view file dialog that pops up, give it a slightly different name such as Administrative Events - Tailored. The name you choose is not significant but is merely how it will be listed in the Custom views and my suggested name will keep it next to the original entry [after you later re-open Event viewer rather than straightaway].

4 Select your new Custom view, click on Filter Current Custom view and the filter dialog will appear without any greyed out entries. It will be a fully functional filter allowing you to make temporary changes to the Custom view.



5 You can also make permanent changes to the new Custom view. Right-click on it, select Properties, click on Edit filter then make the changes on the dialog that appears or in the xml tab.



So this will achieve the filtered Custom view that you want even though it's not quite what you asked for.

All the best,
Denis

 

Event Viewer (MCC.exe) crashes 'System.IO.IOException'

I'm afraid this is another Windows 1903 bug (current ver 1836.175) as it is reproducible on every (?) PC.

• run Event Viewer
• click 'Create Custom View' on the right panel
• create for example a filter for System, events 6005, 6006, give it a name and save it:
  
  
• then click on the left tree "Custom Views" and an mcc.exe crash will occur *Confused reporting a IO error reading "C:\ProgramData\Microsoft\Event Viewer\Views\View_0.xml"

P.S.
To roll-back you can from an admin prompt:
Code: