Monday, June 5, 2023

Useful EventLog XML Filtering

 

Event log filters can be manually edited in the XML to narrow down specific events.  Where the normal filters are insufficient, switch to XML and tick Edit query manually to enter additional search parameters

In this XML filter the filter only returns 7036 Events pertaining to the Background Intelligent Transfer Service as opposed to all the 7036 events


<QueryList>

  <Query Id="0" Path="System">

    <Select Path="System">*[System[(EventID=7036)]]and*[EventData[Data and (Data='Background Intelligent Transfer Service')]]

</Select>

  </Query>

</QueryList>