Windows 2003 event viewer filter

This is on a Server R2 box. It will save as a single Event Log file, which you can then open with your Event Viewer, and won't have the events you didn't select. Powershell's another option, especially if you want to do that for a large number of Event Logs, but I don't have an "exclude Event ID" PS script handy, so I'm not going to punch it up unless you ask nicely.

You can even use PowerShell to parse your EventLogs for you based on any number of factors By now checked on Windows Server this is easily done by prefixing the ID with a minus sign e. I had a very similar situation where I wanted to filter out an entire source instead of a single event ID.

As it turns out, it's pretty easy and it works on anything: event level, event sources, task category, keywords, user, and computer. Click "Filter Current Log", then select the things you want to filter out. If you don't want to see any information-level events, check "Information" next to Event level. If you don't want any events with the "Audit Success" keyword, select "Audit Success" under Keywords.

Now, open the XML tab and check "Edit query manually". I'm going to answer this as I interpreted it - how does one filter out specific event ID values. Check the "Edit query manually" box. A custom query can be made using XPath to filter out specific event ID's or other properties for that matter. Here I am creating a filter for sysmon sourced events that filters out EventID 7 and Sign up to join this community.

The best answers are voted up and rise to the top. Stack Overflow for Teams — Collaborate and share knowledge with a private group. Create a free Team What is Teams?

Learn more. Ask Question. Asked 9 years, 5 months ago. I am getting a warning for the filter manager in the event log, a lot of them, could someone please tell me why this is and what it is? This thread is locked. You can follow the question or vote as helpful, but you cannot reply to this thread.

I have the same question Report abuse. Details required :. Cancel Submit. Previous Next. Vaseem Ahmed. Reply with above information to help you better.

How satisfied are you with this reply? Thanks for your feedback, it helps us improve the site. In reply to Vaseem Ahmed's post on September 13, In reply to rickybur's post on September 19, Hi, Thank you for the reply.

Click ok to the warning popup. In this window, you can type an XML query. After you type in your query, click the Ok button. Add a descriptive name and click the Ok button. You now have a Custom View for any security events that involve the user test9. Perhaps you want to monitor two users - test5 and test9 - for any security events. Inside the search query, we can use the Boolean OR operator to include users that have the name test5 or test9. The query below searches for any security events that include test5 or test9.

At this point you may be asking, where did you come up with SubjectUserName and what else can I filter on?