How to filter the Windows Event Viewer Logs to help resolve problems

I won’t lie, this article is a bit self-serving as I hope it will be used to shrink the amount of information I have to review when I’m helping customers, but learning how to filter information in Windows Event Viewer logs will be helpful if you are trying to resolve a variety of system problems.

What is the Windows Event Viewer?

As defined by Wikipedia, “Event Viewer is a component of Microsoft‘s Windows NT operating system that lets administrators and users view the event logs on a local or remote machine. Applications and operating-system components can use this centralized log service to report events that have taken place, such as a failure to start a component or to complete an action.”

When it comes to troubleshooting SOLIDWORKS PDM issues, the Event Viewer can be an invaluable tool. In fact, the SOLIDWORKS PDM Server log is largely derived from the Event Viewer.

Accessing the SOLIDWORKS PDM Archive Server Log

The problem is that there can be, and usually there is, a lot of entries to review. This where filtering of the logs comes into play. But before we go there let’s first take a look at the Windows Event Viewer.

Accessing the Windows Event Viewer

The Event Viewer can be accessed in the Administrative Tools.

Accessing Event Viewer from Administrative Tools

But I usually access it by entering ‘Event‘ in Windows Start.

There is a lot of information in the Windows Event Viewer, but from a PDM perspective, there are only three we are interested in. These are the Application, System and ConsioArchiveSeverLog.

Windows Event Viewer Focus

Large Log Files

Even with only three logs to concern ourselves with, there is still a lot of information to process. As can be seen from the image below, entries can be added every few seconds, resulting in a very large log.

Sample Server Log

Generally, we are only interested in certain entries and this is where Filters come in.

Accessing Log Filters

Filtering the Event Viewer Log

As seen in the below image, the Event Viewer Log Filter has many options for filtering logs.

Windows Event Log Filters

When I’m troubleshooting, I’m initially interested in Critical, Error and Warning Even Levels. Once I have a few target events in my scope, I will often filter by a time period to look at want other events are happening around that time. Even though those events are normally Information entries, the underlying process may be involved in generating the Critical, Error or Warning entry.

Once filtered, the log can be focused and easier to diagnose.

Filtered Log

Double-clicking one of the log column headers, sorts the log by that column, for example by severity level.

Sorting Log by Double-Clicking Column Headers

The log can also be sorted from the View menu:

Sorting Log from View Pull-Down

Log entries can also be Grouped from the View menu:

Grouping Log Entries

Sharing the log

If you need to share the log, such as with your SOLIDWORKS reseller, you can save the filtered log.

Saving Filtered Log

If you regularly use certain filters, you can create Custom View that contains those filters. Custom Views can be created from the Action pull-down or the Actions panel.

Creating a Custom View

Now the next time your SOLIDWORKS PDM Support Technician asks for your Event logs, you can wow them with your Event Log Skills.