System Restore errors and informational events are logged in the Application event log. With hundreds of other entries added to the Application log every day, inspecting the System Restore events is time-consuming. Every time the user needs to use "Filter the current log" option to display only the System Restore entries, and then clear the filter once the entries are checked. Easier option would be to create a Custom View that lists only the System Restore entries, and this post tells you how.
Start Event Viewer, and click Create Custom View… in the Actions pane.
Configure the Custom View dialog as in the image below, and click OK.
- Event level: All event levels checked. To only view entries that need your action, uncheck "Information" and enable all others.
- By log: Application
- By Source: System Restore. For a thorough analysis, you may want to include VSS entries as well.
This creates a custom System Restore view listed under Custom Views category.
Under Applications and Service Logs > Microsoft > Windows, separate logs are maintained by each application/service; but there isn’t a separate log for System Restore… which is where the Custom View option comes in handy.