Event Viewer filter by source disabled

Question

I've tried looking around other posts here as well as Microsoft community pages but to no luck.

In my environment (Windows 10), the filtering by source is Event Viewer is blank, and I cannot open that drop down menu. This was possible on my old computer (also Windows 10) but recently changed to a new one and ever since I cannot use this function.

I'm not really sure what's going on here. Clicking on the arrow doesn't do anything, and manually entering sources doesn't work either (not that it did even when I could use the drop down menu). Any idea of what the reason for this might be?

Answer 1

I ran into this same problem yesterday at a client on a Windows 10 1809 laptop (I do IT support). I was attempting to filter the event logs by Event Sources. If the down arrow in the event sources drop down selection was selected nothing drops down.

It took a while but I figured out that it was the scaling setting of the monitor in display settings that was interfering.

I tried several things including the possibility of a group policy being the problem.

I tried a different user account in case is was a corrupted user profile. I reset the machine thinking OS issue but kept user settings.

But even after a second full reset (a total wipe, no data kept) the problem still occurred.

This was a laptop with an external monitor attached and the two monitors were using different scaling settings by default.

I stumbled onto the solution when I happened to open the event log filtering window on the 100% scaling monitor. The drop down worked. Then I moved the window to the 125% monitor and the problem occurred. I set that monitor to 100% and the problem did not occur.

I checked and this Lenovo machine was fully updated including the video card driver. There were no available updates in Windows update or on the Lenovo Vantage updates section.

So my conclusion, at least on this laptop, was that scaling interfered with the drop down .

Answer 2

Apparently, there are some limitations in the MS Windows Event Viewer. Some may be intentionally set by Group Policy. There are other limitations imposed by the viewer itself. To some extent, these can be overcome by editing the XML generated (see the XML tab), but the queries may not run in eventvwr. For example, trying to create a flat view of all events is beyond its capability.

You might be better served by a third party tool such as the free Nirsoft's Full Event Log Viewer, which allows for filtering by a number of fields, including source, channel, date range or even the description string, or other alternatives..