事件查看器^{(Event Viewer)}是Windows中隐藏的宝藏工具之一。它可以显示您计算机上发生的几乎所有事情的日志，并且可以帮助您解决计算机可能遇到的任何问题。然而，它所显示的信息在数量和细节^{(amount and details)}上往往是压倒性的。幸运的是，它还提供了对所有信息进行排序和过滤的方法，这样您就可以将其限制在您感兴趣的范围内。在本教程中，我们将探讨如何创建和保存自定义视图，以便您随时关注任何您感兴趣的记录信息类型：

如何在事件查看器中访问^{(Event Viewer)}自定义视图^{(Custom Views)}

在Windows中打开^(Windows)事件查看器^{(Event Viewer)}的方法有很多，我们已经详细讨论了所有这些方法，这里：如何在Windows中启动^(Windows)事件查看器^{(Event Viewer)}（所有版本）。但是，如果您没有时间阅读该指南，启动事件查看器^{(Event Viewer)}的^{("event viewer")}快速方法是在Windows 10的^{(Windows 10)}搜索^{(search box)}框中、Windows 7的开始菜单^{(Start Menu )}搜索框中^{(search box)}或开始屏幕，^{(Start screen, )}如果您使用的是 Windows 8.1。

当您启动Event Viewer时，可能需要一点时间才会出现，因为所有日志都在初始化。您可以看到左窗格^{(left pane)}中的第一个菜单项^{(menu item)}是Custom Views。单击^(Click)或点击它，您应该会看到Windows已经提供了一个自定义视图^{(custom view)}：管理事件^{(Administrative Events)}。单击或点击它。

事件查看器^{(Event Viewer)}的自定义视图^{(Custom Views)}是什么？

创建管理事件^{(Administrative Events)}视图是为了向您显示所有Windows日志中的所有严重、错误^{(Critical, Error,)}和警告^(Warning)事件，因此您应该获得带有不祥标签的大量事件列表。但是，如果您的计算机没有崩溃并且您的软件没有无法正常运行，那么这些不祥的消息并不意味着有任何不祥的事情发生。它们仅供您参考，在大多数情况下，Windows甚至在您看到这些消息之前就已经处理了该问题。

那么，究竟什么是Custom View，为什么值得自己创建一个呢？考虑这种情况：您怀疑您的一个或多个硬盘驱动器出现问题。要了解事件查看器^{(Event Viewer)}是否记录了任何有关它的警告，您必须滚动浏览日志一段时间。如果您可以要求事件查看器^{(Event Viewer)}创建一个仅在安全^(Security)日志中显示硬盘驱动器警告的特殊视图，该怎么办？该视图称为自定义视图^{(Custom View)}。现在让我们看看如何创建一个：

步骤 1^{(Step 1)}。在事件查看器^{(Event Viewer)}中创建自定义视图^{(Custom View)}

在自定义视图^{(Custom Views)}中，单击右侧窗格中的“创建自定义视图”，打开“^{("Create Custom View")}创建自定义视图”^{("Create Custom View")}窗口。保持选中默认的Filter选项卡（XML 选项卡^{(XML tab)}超出了本教程的范围）。

步骤 2^{(Step 2)}。选择自定义视图^{(Custom View)}中显示的事件的时间范围^{(time frame)}

在Logged下拉列表中，选择您要用于Custom View的^{(Custom View)}时间范围^{(time frame)}。您可以使用预定义时间之一或选择自定义范围^{(custom range)}。如果您想使用Windows记录的所有事件创建自定义视图^{(Custom View)}，请选择“任何时间”。^{("Any time.")}

步骤 3^{(Step 3)}。选择包含在您的自定义视图中的^{(Custom View)}事件级别^{(event level)}

接下来，您可以选择要在自定义视图中显示的事件的^{(Custom View)}事件级别^{(Event level)}。您可以选择包含一项、部分或全部事件，这些事件被归类为：

• 严重：^(Critical:)需要您立即关注的事件，通常意味着应用程序或系统组件^{(application or system component)} 发生故障或停止响应^{(failed or stopped responding)}。
• 错误：^(Error:)表明存在问题的事件，但不一定对应用程序或系统组件的福利至关重要。
• 警告^(Warning)：表明潜在问题的事件，但并不意味着问题一定会发生。
• 信息：^{(Information:)}只是发送有关其操作的信息位的事件。
• 详细：^(Verbose:)显示有关事件的详细信息。

如果您有兴趣创建自定义视图^{(Custom View)}以从您的计算机对设备或应用程序进行故障排除，您可能应该选择通过等于Critical和Error的^(Error)事件级别^{(Event level )}来过滤事件。这应该使您的自定义视图^{(Custom View)}更小且更易于使用。

第 4 步^{(Step 4)}。选择^(Choose)您希望自定义视图^{(Custom View)}在哪些事件日志或事件源中搜索信息

接下来，您必须选择用于创建自定义视图^{(Custom View)}的日志或源。您可以选择过滤信息：

• 按日志：^{(By log:)}让您选择要使用的“Windows 日志”^{("Windows Logs")}和“应用程序和服务日志”^{("Applications and Services Logs" )}。“ Windows 日志”^{("Windows Logs")}包括应用程序、安全性、设置、系统^{(Application, Security, Setup, System, )}和转发事件^{(Forwarded Events)}，您可以在本教程中了解更多信息：如何在Windows中使用^(Windows)事件查看器^{(Event Viewer)}。“应用程序和服务日志”^{("Applications and Services Logs" )}包括由安装在您计算机上的应用程序创建的日志，每个人的日志可能不同，具体取决于您使用的程序。
• 按来源：^{(By source:)}根据事件的具体来源更详细地过滤事件。通常，这意味着您可以按创建它们的应用程序或程序过滤事件。

步骤 5^{(Step 5)}。按 ID、任务类别^{(task category)}、关键字、用户和计算机过滤^(Filter)自定义视图^{(Custom View)}中显示的事件

事件查看器^{(Event Viewer)}还允许您通过添加一些其他附加过滤器来进一步自定义自定义视图：^{(Custom View)}

• 事件 ID：^{(Event IDs:)}事件查看器^{(Event Viewer)}中记录的每个事件都有自己的事件 ID^{(Event ID)}，这是一个唯一标识它的数字。如果需要，您可以指定要包含的事件 ID^{(Event ID)}编号和范围。
• 任务类别：^{(Task category:)}仅当您在上一步中选择按来源^{(By source)}过滤事件时才能使用，并且可用的类别因来源而异。
• 关键字：^(Keywords:)由Windows预定义，因此您无法输入自己的单词 - 您可以选择其中哪些用于过滤事件。
• 用户：^(User:)如果您的计算机上有多个用户帐户，您可以使自定义视图^{(Custom View)}仅包括记录在特定用户帐户上的事件。
• 计算机：在服务器上使用，系统管理员可以在服务器上选择要在^{(Computer(s):)}自定义视图^{(Custom View)}中收集事件的计算机。

步骤 6^{(Step 6)}。完成^(Finalize)并保存您的自定义视图^{(Custom View)}

完成自定义自定义视图^{(Custom View)}的所有内容后，单击或点击确定^(OK)。

下一个框要求您为自定义视图^{(Custom View )}命名。键入它，如果您愿意，可以添加描述（它是可选的），然后选择要保存它的事件查看器文件夹。^{(Event Viewer)}默认情况下，即Custom Views ，但您可以根据需要使用您喜欢的任何名称创建一个新文件夹。^{(New Folder)}完成后，单击或点击^{(click or tap)} OK。

请注意，默认设置是让您计算机的所有用户都可以使用您的自定义视图。如果有其他人使用您的计算机并且您不希望他们访问此过滤器，请取消选中右下角的所有用户框。^{(All Users)}

按下OK后，新的自定义过滤器^{(custom filter)}将出现在左侧窗格中。单击^(Click)或点按它，您的选定项目会出现在中央窗格^{(center pane)}中。

如何在事件查看器中保存^{(Event Viewer)}自定义视图^{(Custom Views)}日志

假设您想跟踪特定事件。您可能希望这样做的一个原因是检查您的某些硬件是否产生了很多错误，这可能意味着它很快需要更换。

让我们以我们创建的“系统严重故障”^{("System Critical Failures")} 自定义视图^{(custom view)}为例。单击^(Click)Event Viewer左侧窗格中的自定义视图^{(custom view)}，然后单击右侧窗格中的Refresh，以确保您拥有最新信息。

右键单击您的自定义视图^{(Custom View)}，在我们的例子中是“系统严重故障”^{("System Critical Failures,")}，然后从菜单（或从右窗格，它是右键单击菜单的副本）中选择“将自定义视图中的所有事件另存为。”^{("Save All Events in Custom View As.")}

弹出的框让您选择适当的文件名^{(file name)}和您希望保存此日志的位置。该事件使用“.EVTX” 后缀保存，双击它会在^{(suffix and double-clicking)}Event Viewer中打开它。

如何在事件查看器中导出^{(Event Viewer)}自定义视图^{(Custom Views)}

如果您想将自定义视图^{(Custom View)}另存为文件，然后可以在另一台计算机上使用该文件来创建相同的事件日志，您可以将其导出为XML 文件^{(XML file)}。为此，在事件查看器^{(Event Viewer)}中，右键单击或点击并按住^{(tap and hold)}要导出的自定义视图，然后在右键单击菜单中选择^{(Custom View)}“导出自定义视图”。^{("Export Custom View.")}

在“另存为”^{(Save As)} 对话框窗口^{(dialog window)}中，输入自定义视图^{(Custom View)} XML 文件^{(XML file)}的名称，然后选择要将其导出到的文件夹。

如何在事件查看器中导入^{(Event Viewer)}自定义视图^{(Custom Views)}

如果您有一个保存为“.XML”文件的^(".XML")自定义视图^{(Custom View)}，您可以在同一台甚至另一台也运行Windows的计算机上的^(Windows)Event Viewer中导入它。为此，在事件查看器^{(Event Viewer)}中，单击或点击左侧窗格^{(left pane)}中的自定义视图^{(Custom Views)}，然后单击或点击右键菜单中的“导入自定义视图” 。^{("Import Custom View")}请注意，您可以在事件查看器^{(Event Viewer)}右侧的面板中找到相同的选项。

导航到找到XML 自定义视图^{(XML Custom View )}文件的文件夹，选择它，然后单击或点击打开^(Open)。

在“导入自定义视图文件”中，^{("Import Custom View File,")}您可以看到正在导入的自定义视图^{(Custom View)}的详细信息。单击^(Click)或点击OK。

自定义视图^{(Custom View)}文件现在已导入并显示在事件查看器^{(Event Viewer)}的左窗格中，向您显示通过它过滤的所有事件。

结论

Windows使许多事情变得如此简单，以至于我们无需考虑后台发生的事情。使用事件查看器查看^{(Event Viewer)}日志可以让您了解您从未见过的所有内务管理，并帮助您了解Windows的运行情况。看看你能做什么是很值得的，即使你除了看什么都不做。您认为事件查看器^{(Event Viewer)}对您来说是一个有用的工具吗？请发表评论并分享^{(comment and share)}您的意见。

How to work with custom views in Event Viewer (all Windows versions)

Event Viewer is one of those tools in Windows that are hidden treasures. It can show logs about pretty much everything that happened on your computer, and it can help you troubleshoot any problems your computer might have. However, the information it shows can often be overwhelming in amount and details. Fortunately, it also offers ways of sorting and filtering all that information so that you can limit it only to what you are interested in. In this tutorial, we will explore how to create and save custom views, so you can keep an eye on any kind of logged information that you are interested in:

How to access the Custom Views in Event Viewer

There are many ways to open Event Viewer in Windows, and we have talked about all of them in detail, here: How to start the Event Viewer in Windows (all versions). However, if you do not have the time to read that guide, a fast way of launching Event Viewer is by typing "event viewer" into the search box from Windows 10, in the Start Menu search box from Windows 7, or on the Start screen, if you are using Windows 8.1.

When you launch Event Viewer, it may take a moment to appear, as all the logs are being initialized. You can see that the first menu item in the left pane is Custom Views. Click or tap on that, and you should see that Windows has already provided one custom view: Administrative Events. Click or tap on it.

What are the Custom Views from Event Viewer?

The Administrative Events view was created to show you all the Critical, Error, and Warning events from all the Windows logs, so you should get a massive list of events with ominous tags. However, if your computer did not crash and your software did not fail to work correctly, these ominous messages do not mean there is anything ominous going on. They are just for your information, and in most cases, Windows has already dealt with the problem before you even saw the messages.

So what, exactly, is a Custom View, and why would it be worth creating one of your own? Consider this situation: you suspect that there is something wrong happening with one or more of your hard drives. To find out if Event Viewer recorded any warnings about it, you would have to scroll through the logs for quite a while. What if you could ask Event Viewer to create a special view that would display only the hard drive warnings in the Security log? That view is called a Custom View. Now let's see how to create one:

Step 1. Create a Custom View in Event Viewer

In Custom Views, click on "Create Custom View" in the right pane, to open a "Create Custom View" window. Keep the default Filter tab selected (the XML tab is beyond the scope of this tutorial).

Step 2. Select the time frame for the events shown in the Custom View

In the Logged drop-down list, select the time frame that you to use for the Custom View. You can use one of the predefined times or choose a custom range. If you want to create a Custom View with all the events ever recorded by Windows, choose "Any time."

Step 3. Select the event level that is included in your Custom View

Next, you can select the Event level for the events that are going to be shown in your Custom View. You can choose to include one, some or all of the events classified as:

• Critical: events that require your immediate attention, and generally mean that an application or system component failed or stopped responding.
• Error: events that show problems exist, but which are not necessarily critical to the welfare of the application or of system components.
• Warning: events that indicate potential problems, but which do not mean problems are sure to happen.
• Information: events that are simply sending bits of information about their operation.
• Verbose: shows detailed information about events.

If you are interested in creating a Custom View for troubleshooting a device or an application from your computer, you should probably choose to filter the events by an Event level equal to Critical and Error. That should keep your Custom View small and easier to work with.

Step 4. Choose in which event logs or event sources you want the Custom View to search for information

Next, you must select the logs or the sources that are used for creating the Custom View. You can choose to filter information:

• By log: lets you select the "Windows Logs" and the "Applications and Services Logs" that you want to use. The "Windows Logs" include Application, Security, Setup, System, and Forwarded Events, and you can read more about them in this tutorial: How to work with the Event Viewer in Windows. The "Applications and Services Logs" include logs created by applications installed on your computer, and they can be different for everyone, depending on what programs you are using.
• By source: filters the events in more detail, according to their specific sources. Usually, that means that you can filter events by the applications or programs that have created them.

Step 5. Filter the events shown in your Custom View by ID, task category, keywords, users and computers

Event Viewer also lets you further customize your Custom View by adding a few other additional filters:

• Event IDs: each event recorded in Event Viewer get its own Event ID, which is a number that uniquely identifies it. If you want, you can specify Event ID numbers and ranges that are to be included.
• Task category: can be used only if you chose to filter the events By source at the previous step, and the categories available differ according to the source.
• Keywords: are predefined by Windows, so you cannot enter your own words - you can select which of them are to be used for filtering events.
• User: if there are multiple user accounts on your computer, you can make the Custom View include only events recorded on specific user accounts.
• Computer(s): is used on servers, on which system administrators can select the computers from which to gather events in the Custom View.

Step 6. Finalize and save your Custom View

Once you have finished customizing everything about your Custom View, click or tap on OK.

The next box asks you to give your Custom View a name. Type it, add a description if you like (it is optional) and select the Event Viewer folder in which you want to save it. By default, that is Custom Views, but you can create a New Folder if you want, using any name you prefer. When done, click or tap OK.

Note that the default is to have your custom views available to all users of your computer. If there are other people who use your computer and you do not want them to have access to this filter, uncheck the All Users box in the lower right corner.

After you have pressed OK, your new custom filter appear in the left pane. Click or tap on it, and see your selected items appear in the center pane.

How to save Custom Views logs in Event Viewer

Let's say you wanted to keep track of specific events. One reason you might wish to do this is to check to see if some of your hardware is generating a lot of errors, which might mean it will soon need to be replaced.

Let's take for example the "System Critical Failures" custom view that we have created. Click on the custom view in the left pane of Event Viewer, and then, just to be sure, click on Refresh in the right pane, to make sure you have the latest information.

Right-click on your Custom View, which in our case is "System Critical Failures," and from the menu (or from the right pane, which is a duplicate of the right-click menu) choose "Save All Events in Custom View As."

The box that pops up lets you choose an appropriate file name and a location where you want this log to be saved. The event is saved using the ".EVTX" suffix and double-clicking on it opens it up in Event Viewer.

How to export Custom Views in Event Viewer

If you want to save your Custom View as a file which you can then use on another computer to create the same event logs, you can export it as an XML file. To do that, in Event Viewer, right-click or tap and hold on the Custom View that you want to export and, in the right-click menu, choose "Export Custom View."

In the Save As dialog window, type a name for the Custom View XML file and select the folder in which you want to export it.

How to import Custom Views in Event Viewer

If you have a Custom View saved as an ".XML" file, you can import it in Event Viewer, on the same or even on another computer that also runs Windows. To do that, in Event Viewer, click or tap on Custom Views in the left pane, and then click or tap on "Import Custom View" in the right-click menu. Note that you can find the same option in the panel from the right side of Event Viewer.

Navigate to the folder in which the XML Custom View file is found, select it and then click or tap on Open.

In the "Import Custom View File," you can see the details of the Custom View that you are importing. Click or tap on OK.

The Custom View file is now imported and displayed in the left pane of Event Viewer, showing you all the events filtered through it.

Conclusion

Windows makes so many things so easy that we never need to think about what is going on in the background. Taking a look at the logs with the Event Viewer can give you an idea of all the housekeeping that you never see, and help you appreciate just how well Windows works. It is well worth taking a look at what you can do, even if you do not do anything more than look. Do you think the Event Viewer could be a useful tool for you? Please leave a comment and share your opinions.

Related posts

• 如何在 Windows 中使用事件查看器

• 在 Windows 10 和 Windows 11 中打开事件查看器的 11 种方法

• 如何使用诊断数据查看器了解 Windows 10 中的哪些问题

• 6种方法退出Windows 11

• 查找Windows安装时。它是什么原件install date？

• 什么是 Windows 中的 PowerShell，你可以用它做什么？

• 如何在Windows退出Safe Mode

• 如何从靴子进行Windows System Restore，而无需到达桌面

• 如何在Windows 10中创建用户变量和system environment变量

• 如何从USB，DVD或ISO安装Windows 11

• 如何在 Windows 8 和 8.1 中的 USB 记忆棒上创建恢复驱动器

• 如何暂停Windows 10 May 2021 Update的更新

• 什么是Ctrl Alt Delete？ Ctrl Alt Del做了什么？

• 如何使用Storage Sense清理Windows 10

• 如何关闭Windows 11（9种方式）

• Windows 10 Media Creation Tool：创建setup USB stick or ISO

• Windows 10 Update Assistant：升级到May 2021 Update today！

• 在Windows 11和Windows 10中打开Control Panel的17种方法

• 如何降级Windows 11并滚回Windows 10

• 系统要求：我的电脑可以运行Windows 11吗？