guide · static export
PC · eventlog

Build a Custom Event View That Watches One Problem

Instead of scrolling a log with a hundred thousand entries, one saved view can show only the failures you care about — and survive reboots, log rotation and a machine rebuild.

by@guidox updated:10/31/26 time:20 min level:Intermediate tested on:Windows 11 24H2 works on:Windows 10, Windows 11, Windows Server 2019 tools:Event Viewer, PowerShell as administrator
TL;DR

Create a custom view in **eventvwr.msc**, switch to the **XML** tab and write the **FilterXPath** by hand, then save it as a view file you can copy to other machines.

Before you start

Requirements

  • Admin rights
  • A problem that already produced events
  • 20 minutes
Step by step

Instructions

01

Find the events you want to keep

Start from a real failure and note the **log name**, the **provider** and the **event ID**. A view built from a guess is a view that stays empty.

Get-WinEvent -LogName System -MaxEvents 20 | Select-Object TimeCreated,Id,ProviderName,LevelDisplayName
02

Create the view and switch to XML

**eventvwr.msc > Custom Views > Create Custom View** gives you checkboxes, which cannot express a time window or a provider exclusion. The XML tab can.

eventvwr.msc
:: Custom Views > Create Custom View > XML tab > Edit query manually
03

Write the filter by hand

The **timediff** condition limits the window in milliseconds, and parentheses keep the logic honest. Seven days is 604800000.

<QueryList>
  <Query Id="0" Path="System">
    <Select Path="System">*[System[(EventID=41 or EventID=1001 or EventID=6008) and TimeCreated[timediff(@SystemTime) &lt;= 604800000]]]</Select>
  </Query>
</QueryList>
tip**&lt;** has to be escaped inside the XML query. A raw less-than sign is the most common reason the view refuses to save.
04

Save the view so it can be copied

Every custom view is a file under ProgramData. Copying that file to another machine recreates the view after an Event Viewer restart, which is faster than clicking through the wizard again.

Get-ChildItem "$env:ProgramData\Microsoft\Event Viewer\Views" -Recurse | Select-Object FullName,Length
Copy-Item "$env:ProgramData\Microsoft\Event Viewer\Views\System\MyView.xml" C:\Temp\ -Force
05

Run the same query without the UI

**Get-WinEvent -FilterXPath** accepts the select expression, so the view and your scripts always agree on what counts as a problem.

$x = "*[System[(EventID=41 or EventID=1001) and TimeCreated[timediff(@SystemTime) <= 604800000]]]"
Get-WinEvent -LogName System -FilterXPath $x -MaxEvents 20 | Select-Object TimeCreated,Id,ProviderName
06

Attach an action, not just a filter

A view tells you; a task can react. **Attach Task to This Custom View** runs a script on the first matching event, and the event log tells you when it fired.

:: right-click the custom view > Attach Task to This Custom View
Get-WinEvent -LogName 'Microsoft-Windows-TaskScheduler/Operational' -MaxEvents 5 | Select-Object TimeCreated,Id
⚠ warningGive the attached task a throttle. An event that fires a hundred times an hour should not start a hundred script runs.
Troubleshooting

Common issues

The view is empty although the events exist

Wrong log path or an ID that belongs to another provider. Test the same expression with Get-WinEvent -FilterXPath before you blame the view.

Saving fails with a query error

Unescaped characters or a missing QueryList wrapper. Compare with a view that works and check every ampersand and angle bracket.

The query is slow on a large log

A suboptimal filter forces a full scan. Always include the System block with the event IDs; that part is indexed.

The attached task never runs

The action runs as SYSTEM by default and has no network or profile. Check the task history and the last result code.

FAQ

Frequently asked

Can a custom view span several logs?

Yes, add one Query element per log inside the same QueryList. Keep it to two or three, or the view becomes slow to open.

Do custom views survive a feature update?

The files live in ProgramData and usually do. Copy them somewhere safe if the view matters to you.

How to undo this

Delete the view with a right-click > Delete in Event Viewer, or remove the XML file from the Views folder. If you attached a task, delete that task too.

Changelog · 1 entry
  1. 2026-10-31
    First version
Interactive version: checklist, feedback, related guides →

Free · no account needed · tracks your progress