Create a console for persistent filters in Windows 2000 Server's Event Viewer

by Jim Boyce | Mar 20, 2006 8:00:00 AM

Tags: Servers, Jim Boyce, server, Event Viewer, console, Microsoft Windows 2000, Microsoft Windows, Microsoft Windows 2000 Server, Windows 2000 Server Tips Newsletter

2 comment(s)

Takeaway: When you close the Event Viewer console in Windows 2000 Server, any filter you may have set is lost. In this tip, Jim Boyce tells how to create a default setting for the Event Viewer, customizing your most frequently used filters.

Windows 2000 Server's Event Viewer enables you to view events in each of the event logs. Locating specific events in a log, even if you configure the log for a relatively small maximum size, can be difficult. The Event Viewer includes the capability to filter the log for specific types of events to minimize that potential problem.

When you close the Event Viewer console, any filter you have set is lost. The next time you open the Event Viewer, you see all default events. However, you can create your own Event Viewer console to retain a filter from session to session.

Follow these steps to create the console:

Go to Start | Run and type MMC to open the MMC console.
Choose Console | Add/Remove Snap-in. Select Add | Event Viewer | Add and then click Finish, Close, and OK.
With the Event Viewer open in the console, open an Event Log and set the desired filter.
Repeat step 3 for other logs as desired.
Close the console and when prompted, click Yes to save the console. Specify a name such as Filtered_Events.msc and click Save. Windows Server by default will save the file in the Administrative Tools folder unless you specify otherwise.

To test your new filtered Event Viewer, open the Filtered_Events console and review the contents of the filtered event logs. The console should save the filter changes each time you close it.