[jcallis]

On windows server 2000 how can you tell the event viewer to ignore and not log certain event id's?

Edited by jcallis, 06 July 2005 - 05:13 AM.

[Advertisements]

Wait to see if, u get other replies, otherwise I can give u a method to stop logging events according to the source not event-id.
Also can u mention the event source for which U want to stop logging events; I will check to see if that source has multiple event-ids or not. If it is the latter case(i.e. the source has only one event id) we can safetly stop logging according to source.

Edited by darth_ash, 06 July 2005 - 08:35 AM.

[darth_ash]

Wait to see if, u get other replies, otherwise I can give u a method to stop logging events according to the source not event-id.
Also can u mention the event source for which U want to stop logging events; I will check to see if that source has multiple event-ids or not. If it is the latter case(i.e. the source has only one event id) we can safetly stop logging according to source.

Edited by darth_ash, 06 July 2005 - 08:35 AM.

[jcallis]

That would likely do it. Let me know when you can.

Thanks

[darth_ash]

1) Open regedit.

Note: For the other steps, I have used the some variables, they are defined below:
xxxx: Type of log; i.e. either Application, Security or System
yyyy: The name of the source that generated the event as seen seen in "Event Viewer". e.g.: Userenv, MsiInstaller,


2) Go to "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\xxxx"
Double-click on the Sources value, to open the edit dialog. Remove the Source name from the list (i.e. yyyy).

3) Again in,"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\xxxx" Delete the yyyy key(sub-folder).


P.S: If u find it difficult to understand i will give u an example.

[jcallis]

Done. Now to see how it goes. Thanks.