Filtering Event Logs

Written by Barry Dysert (last updated July 27, 2020)

The Windows Event Viewer captures a lot of information about your system – so much so that it may sometimes be hard to find what you're looking for. That's why the ability to filter logs is so handy. For example, let's say you want to see the times when the computer has been shut down or restarted. Start by displaying the Event Viewer. (The easiest way to do this is to use the search capabilities of Windows to look for "Event Viewer", without the quote marks.) (See Figure 1.)

Figure 1. Event Viewer main screen.

Since we're interested in system starts and shutdowns, use the left pane of the screen to navigate to Application and Services Logs | Microsoft | Windows | Diagnostics-Performance | Operational. After drilling down that far, the Event Viewer screen should be quite different from the main one you previously saw. (See Figure 2.)

Figure 2. Navigating to the

In the right pane, near the top, click on Filter Current Log. Windows displays the Filter Current Log dialog box. The Filter tab should be displayed in the dialog box. (See Figure 3.)

Figure 3. The Filter Current Log dialog box.

Here you can specify quite a few options: the time the event was logged, what event level you're interested in, what log and source are to be used, the Event IDs to include, the keywords to be used to filter the log, and the user and computers related to the log.

Since we are interested in startups and shutdowns at any time, for any event level, and since we've already navigated to the correct event log, we don't need to change anything here. Similarly, we don't care about the event sources or really anything else on the screen except for the Event IDs. As it turns out, a Windows startup is denoted by the Event ID of 100, and a Windows shutdown is denoted by the Event ID of 200. So, all we need to do is enter the two numbers, separated by a comma, into the textbox that currently says "<All Event IDs>.

Go ahead and enter "100,200" (without the quotes) in the textbox. Once you click OK, the log you're looking at immediately becomes filtered to only include those events whose ID is either 100 or 200. Now you can easily skim through the log and see the details related to each restart.

 This tip (12829) applies to Windows 7, 8, and 10.

Author Bio

Barry Dysert

Barry has been a computer professional for over 35 years, working in different positions such as technical team leader, project manager, and software developer. He is currently a software engineer with an emphasis on developing custom applications under Microsoft Windows. When not working with Windows or writing Tips, Barry is an amateur writer. His first non-fiction book is titled "A Chronological Commentary of Revelation." ...

MORE FROM BARRY

Understanding Windows Firewall

There are a lot of malicious users on the Internet who are trying to break into other people's systems. One way to ...

Discover More

Using Windows Easy Transfer

If you ever want to copy user accounts, documents, pictures, etc., from one computer to another, you'll find that Windows ...

Discover More

Getting to Know the Ease of Access Center

Do you have hearing, vision, or mobility impartments? Windows 10 offers a range of modifications in the Ease of Access ...

Discover More
More WindowsTips

Deleting Events in Your Event Logs

You don't need to worry about event logs filling up your disk, but you still may want to clean them out eventually. This ...

Discover More

Changing How Event Log Overruns are Handled

By default, the event logs are implemented in a circular buffer, i.e., when its maximum size is reached, the oldest ...

Discover More

What is the Purpose of the System Event Log?

The System event log holds messages generated by device drivers. This tip explains more about it.

Discover More
Comments

If you would like to add an image to your comment (not an avatar, but an image to help in making the point of your comment), include the characters [{fig}] (all 7 characters, in the sequence shown) in your comment text. You’ll be prompted to upload your image when you submit the comment. Maximum image size is 6Mpixels. Images larger than 600px wide or 1000px tall will be reduced. Up to three images may be included in a comment. All images are subject to review. Commenting privileges may be curtailed if inappropriate images are posted.

What is six more than 1?

There are currently no comments for this tip. (Be the first to leave your comment—just use the simple form above!)


Newest Tips