Скачать или смотреть Windows Event Viewer Filtering and Custom Views - Microsoft Windows

Learn about Microsoft Windows Event Viewer filtering and Custom Views,

Query filter for Application XPath in Microsoft Windows Event Viewer

Windows Event Viewer query string for Error (Level 2)
＜QueryList＞
＜Query Id="0" Path="Application"＞
＜Select Path="Application"＞
*[System[Level=2]]
＜/Select＞
＜/Query＞
＜/QueryList＞

Level 0 (Log Always): This is the least severe level and indicates that the event should always be logged, regardless of severity. Events with Level=0 are typically used for debugging or verbose information. It doesn't necessarily imply an error or warning, but that the event contains information that may be useful for diagnosing or monitoring certain activities. This level is not typically used for critical events.
Other levels for context:
Level 1 (Critical): A critical problem that caused the system to crash or a failure of a critical service or application.
Level 2 (Error): An error that is non-critical but requires attention. For example, a failed operation or service.
Level 3 (Warning): An event that indicates potential problems that might not require immediate action but should be investigated.
Level 4 (Information): General information about the operation of a service or application.
Level 5 (Verbose): More detailed information typically used for troubleshooting or debugging.

Windows Event Viewer query string for Error (Level 2) and Warning (Level 3)
＜QueryList＞
＜Query Id="0" Path="Application"＞
＜Select Path="Application"＞
*[System[Level=2 or Level=3]]
＜/Select＞
＜/Query＞
＜/QueryList＞

Windows Event Viewer query string for Error (Level 2) and specific date range.
＜QueryList＞
＜Query Id="0" Path="Application"＞
＜Select Path="Application"＞
*[System[Level=2
and
TimeCreated[@SystemTime>='2024-09-01T11:23:00.000Z' and @SystemTime<='2024-09-25T13:00:00.000Z']]]
＜/Select＞
＜/Query＞
＜/QueryList＞


Windows Event Viewer query string for everything
＜QueryList＞
＜Query Id="0" Path="Application"＞
＜Select Path="Application"＞*＜/Select＞
＜/Query＞
＜/QueryList＞



-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=


Query filter for Application XPath in Microsoft Windows Event Viewer (Scheduler)

Windows Event Viewer query string for Warnings (Level 3) for TaskScheduler
＜QueryList＞
＜Query Id="0" Path="Microsoft-Windows-TaskScheduler/Maintenance"＞
＜Select Path="Microsoft-Windows-TaskScheduler/Maintenance"＞
*[System[Level=3]]
＜/Select＞
＜/Query＞
＜/QueryList＞

Windows Event Viewer query string for Warnings (Level 3) and specific date range for TaskScheduler
＜QueryList＞
＜Query Id="0" Path="Microsoft-Windows-TaskScheduler/Maintenance"＞
＜Select Path="Microsoft-Windows-TaskScheduler/Maintenance"＞
*[System[Level=3
and
TimeCreated[@SystemTime>='2024-09-01T11:23:00.000Z' and @SystemTime<='2024-09-25T13:00:00.000Z']]]
＜/Select＞
＜/Query＞
＜/QueryList＞

Windows Event Viewer query string for everything in TaskScheduler
＜QueryList＞
＜Query Id="0" Path="Microsoft-Windows-TaskScheduler/Maintenance"＞
＜Select Path="Microsoft-Windows-TaskScheduler/Maintenance"＞*＜/Select＞
＜/Query＞
＜/QueryList＞

#tips #excel #shorts #fyp