{"id":19493,"date":"2020-10-24T05:59:46","date_gmt":"2020-10-24T00:29:46","guid":{"rendered":"http:\/\/198.58.113.91\/blog\/?p=19493"},"modified":"2025-03-06T18:35:57","modified_gmt":"2025-03-06T13:05:57","slug":"jump-directly-to-specific-event-log-eventvwr","status":"publish","type":"post","link":"https:\/\/www.winhelponline.com\/blog\/jump-directly-to-specific-event-log-eventvwr\/","title":{"rendered":"How to Jump to a Specific Event Log (Channel) Directly in Event Viewer"},"content":{"rendered":"<p>The event logging service in Windows records important <a href=\"https:\/\/www.winhelponline.com\/blog\/fix-event-id-10016-distributedcom-error-event-log-dcomcnfg-permissions\/\">software<\/a> and <a title=\"Fix: Device Harddisk DR0 has a \u201cbad block\u201d Error in Event Viewer\" href=\"https:\/\/www.winhelponline.com\/blog\/fix-device-harddisk-dr0-has-a-bad-block-error-in-event-viewer\/\">hardware events<\/a> from various sources and stores them in a collection named event log. There are various event log channels in addition to the well-known built-in channels like Application, System, Security, etc.\u00a0The Event Viewer (<code>eventvwr.msc<\/code> or <code>eventvwr.exe<\/code>) enables you to view these logs.<\/p>\n<p>Here is a sample list of the channels or logs seen in the Event Viewer window.<\/p>\n<ul>\n<li>Microsoft-Windows-Store\/Operational<\/li>\n<li>Microsoft-Windows-GroupPolicy\/Operational<\/li>\n<li>Microsoft-Windows-StateRepository\/Operational<\/li>\n<li>Microsoft-Windows-AppXDeploymentServer\/Operational<\/li>\n<li>Microsoft-Windows-EapHost\/Operational<\/li>\n<li>Microsoft-Client-Licensing-Platform\/Admin<\/li>\n<li><a href=\"https:\/\/www.winhelponline.com\/blog\/clear-task-scheduler-history-windows\/\">Microsoft-Windows-TaskScheduler\/Operational<\/a><\/li>\n<li>Microsoft-Windows-FileHistory-Engine\/File History backup log<\/li>\n<\/ul>\n<p>For instance, to view <code>Microsoft-Windows-FileHistory-Engine\/File History backup log<\/code>, usually, one would open the Event Viewer and then navigate to the following branch manually:<\/p>\n<pre>Applications and Service Logs \u2192 Microsoft \u2192 Windows \u2192 FileHistory-Engine \u2192 File History backup log<\/pre>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-19495\" src=\"https:\/\/www.winhelponline.com\/blog\/wp-content\/uploads\/2020\/10\/eventvwr-jump-0.png\" alt=\"event viewer jump to a log directly\" width=\"700\" height=\"437\" \/><!--more--><\/p>\n<div class=\"rp\"><strong>SIMILAR:<\/strong> <a href=\"https:\/\/www.winhelponline.com\/blog\/regjump-quickly-jump-registry-path-clipboard\/\">Jump to a Registry Key (Stored in Clipboard) Directly Using RegJump<\/a><\/div>\n<h2>Jump Directly to a Specific Event Log in Event Viewer<\/h2>\n<p>If you&#8217;re going to check this <a href=\"https:\/\/www.winhelponline.com\/blog\/how-to-use-the-file-history-feature-in-windows-8-and-10\/\">File History<\/a> event log channel many times in a day, then there is an easier option for you. Simply create a desktop shortcut with the following command-line.<\/p>\n<p>The command-line would open the Event Viewer and jump to the mentioned log or channel directly.<\/p>\n<pre>mmc.exe eventvwr.msc \/c:\"Microsoft-Windows-FileHistory-Engine\/BackupLog\"<\/pre>\n<div class=\"qt\">\n<h3>Event Viewer command-line parameters (full list)<\/h3>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-19498\" src=\"https:\/\/www.winhelponline.com\/blog\/wp-content\/uploads\/2020\/10\/eventvwr-commandline.png\" alt=\"eventvwr command-line parameters list\" width=\"542\" height=\"617\" \/><\/p>\n<p>Eventvwr [&lt;computer name&gt;] [\/v:&lt;query or view file&gt;] [\/l:&lt;log file&gt;] [\/c:&lt;channel&gt;] [\/f:&lt;filter&gt;] [\/?]<\/p>\n<ul>\n<li>&lt;computer name&gt; &#8212; Specifies the computer name of the machine to view events for. If this is not given, local machine is assumed.<\/li>\n<li>\/v:&lt;query or view file&gt; &#8212; Specifies a query or a view file created by event viewer. Query file must contain a valid Crimson XML query, starts with &lt;QueryList&gt;; View file contains the XML query string along with other settings, but doesn&#8217;t contain events. This option is mutually exclusive with \/c and \/l.<\/li>\n<li>\/l:&lt;log file&gt; &#8212; Specifies the log file to be opened. This log file should be an exported evtx, evt or etl file. This option is mutually exclusive with \/v and \/c.<\/li>\n<li>\/c:&lt;channel&gt; &#8212; Specifies the name of the channel to be selected when the viewer starts. This option is mutually exclusive with \/v and \/l.<\/li>\n<li>\/f:&lt;filter&gt; &#8212; If used in conjunction with \/c or \/l, this specifies the filter to be applied to the channel or log, in the form of an XPath query; if not in conjunction with \/c or \/l, this must be a valid Event Log XML query that starts with &lt;QueryList&gt;. If the query contains a space, then the entire query must be enclosed in double quotes. If the query itself contains double quotes, then you must change the double quotes in the query to single quotes. For example, the XML query &lt;QueryList&gt;&lt;Query Id=\u201d0\u201d Path=\u201dSystemA\u201d&gt;&lt;Select Path=\u201dSystemB\u201d&gt;*[System[(Level=2)]]&lt;\/Select&gt;&lt;\/Query&gt;&lt;\/QueryList&gt; must be specified as \/f:\u201d &lt;QueryList&gt;&lt;Query Id=&#8217;0&#8242; Path=&#8217;System&#8217;&gt;&lt;Select Path=&#8217;System&#8217;&gt;*[System[(Level=2)]]&lt;\/Select&gt;&lt;\/Query&gt;&lt;\/QueryList&gt;\\\u201d<\/li>\n<li>\/? &#8212; Shows this usage message.<\/li>\n<\/ul>\n<\/div>\n<div class=\"rp\"><strong>RELATED:<\/strong> <a href=\"https:\/\/www.winhelponline.com\/blog\/wevtutil-error-specified-channel-not-found-event-log-file\/\">Wevtutil Error &#8220;The specified channel could not be found&#8221; when clearing an Event Log File<\/a><\/div>\n<h3>What about custom views?<\/h3>\n<p>If you&#8217;ve created <a href=\"https:\/\/www.winhelponline.com\/blog\/custom-view-system-restore-event-log-viewer\/\">custom views<\/a> to view\/filter specific events, they&#8217;re listed under the <strong>Custom Views<\/strong> section of the Event Viewer.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-19496\" src=\"https:\/\/www.winhelponline.com\/blog\/wp-content\/uploads\/2020\/10\/eventvwr-jump-2.png\" alt=\"event viewer jump to a log directly\" width=\"700\" height=\"294\" \/><\/p>\n<p>Each custom view is linked to an XML file located in one of the following folders:<\/p>\n<pre>%ProgramData%\\Microsoft\\Event Viewer\\Views\r\n\r\n%LocalAppData%\\Microsoft\\Event Viewer\\Views<\/pre>\n<p>The file names are <code>View_0.xml<\/code>, <code>View_1.xml<\/code>, <code>View_2.xml<\/code>, and so forth. To know the corresponding XML file name of a custom view item, you may have to view each XML file in those folders manually.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-19497\" src=\"https:\/\/www.winhelponline.com\/blog\/wp-content\/uploads\/2020\/10\/eventvwr-jump-3.png\" alt=\"event viewer jump to a log directly\" width=\"701\" height=\"324\" \/><\/p>\n<p>To jump directly to a custom view, you need to use the eventvwr.msc command-line with the <code>\/v<\/code> parameter. And, you need to mention the XML file name of that particular custom view item.<\/p>\n<p>For instance, the &#8220;Errors during last 24 hrs&#8221; custom view is powered by the XML file named View_8.xml. So, I&#8217;d use this command-line to open Event Viewer directly to that custom view item.<\/p>\n<pre>mmc.exe eventvwr.msc \/v:\"C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\View_8.xml\"<\/pre>\n<p>Though you&#8217;re able to jump to a specific channel or custom view directly using this method, you may not see improvement in the Event Viewer load time.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>The event logging service in Windows records important software and hardware events from various sources and stores them in a collection named event log. There are various event log channels in addition to the well-known built-in channels like Application, System, Security, etc.\u00a0The Event Viewer (eventvwr.msc or eventvwr.exe) enables you to view these logs. Here is &#8230; <a title=\"How to Jump to a Specific Event Log (Channel) Directly in Event Viewer\" class=\"read-more\" href=\"https:\/\/www.winhelponline.com\/blog\/jump-directly-to-specific-event-log-eventvwr\/\" aria-label=\"Read more about How to Jump to a Specific Event Log (Channel) Directly in Event Viewer\">Read more<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[7],"tags":[779],"class_list":["post-19493","post","type-post","status-publish","format-standard","hentry","category-windows","tag-event-viewer"],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"jetpack-related-posts":[{"id":893,"url":"https:\/\/www.winhelponline.com\/blog\/clear-task-scheduler-history-windows\/","url_meta":{"origin":19493,"position":0},"title":"How to Clear Task Scheduler History in Windows","author":"Ramesh","date":"April 23, 2009","format":false,"excerpt":"Task Scheduler in Windows tracks events for each scheduled task when the task history option is enabled for the task. The task history can be viewed by opening the task properties and clicking the History tab. The entries are stored in the Microsoft-Windows-TaskScheduler event log. Use the instructions in this\u2026","rel":"","context":"In &quot;Windows&quot;","block_context":{"text":"Windows","link":"https:\/\/www.winhelponline.com\/blog\/category\/microsoft\/windows\/"},"img":{"alt_text":"clear task scheduler history in event log","src":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2009\/04\/clear-scheduled-tasks-history.png?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2009\/04\/clear-scheduled-tasks-history.png?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2009\/04\/clear-scheduled-tasks-history.png?resize=525%2C300&ssl=1 1.5x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2009\/04\/clear-scheduled-tasks-history.png?resize=700%2C400&ssl=1 2x"},"classes":[]},{"id":10532,"url":"https:\/\/www.winhelponline.com\/blog\/trigger-launch-program-script-connecting-to-specific-network\/","url_meta":{"origin":19493,"position":1},"title":"Trigger a Program Upon Connecting to a Specific Network in Windows","author":"Ramesh","date":"July 30, 2019","format":false,"excerpt":"Depending upon the network you're connected to, you may want to run certain tasks. For instance, when you're connected to a specific network -- e.g., home network -- you may want to assign a different printer as the default, using command-line or script. This is especially needed in Windows 10\u2026","rel":"","context":"In &quot;Windows 10&quot;","block_context":{"text":"Windows 10","link":"https:\/\/www.winhelponline.com\/blog\/category\/microsoft\/windows\/windows-10\/"},"img":{"alt_text":"trigger launch program when connecting to a specific network connection","src":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2019\/07\/trigger-run-program-network-connection-5.png?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2019\/07\/trigger-run-program-network-connection-5.png?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2019\/07\/trigger-run-program-network-connection-5.png?resize=525%2C300&ssl=1 1.5x"},"classes":[]},{"id":50678,"url":"https:\/\/www.winhelponline.com\/blog\/export-event-logs-event-viewer\/","url_meta":{"origin":19493,"position":2},"title":"How to Export Windows Event Logs from Event Viewer","author":"Ramesh","date":"June 1, 2023","format":false,"excerpt":"The Windows Event logs provide very valuable information for diagnosing problems on the computer. Event logs store records of significant events on behalf of the system and applications running on the system. This article tells you how to export the event logs to a file using the Event Viewer or\u2026","rel":"","context":"In &quot;Windows 10&quot;","block_context":{"text":"Windows 10","link":"https:\/\/www.winhelponline.com\/blog\/category\/microsoft\/windows\/windows-10\/"},"img":{"alt_text":"export event logs evtx - locale metadata","src":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2023\/06\/export-event-log-3.png?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2023\/06\/export-event-log-3.png?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2023\/06\/export-event-log-3.png?resize=525%2C300&ssl=1 1.5x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2023\/06\/export-event-log-3.png?resize=700%2C400&ssl=1 2x"},"classes":[]},{"id":1814,"url":"https:\/\/www.winhelponline.com\/blog\/custom-view-system-restore-event-log-viewer\/","url_meta":{"origin":19493,"position":3},"title":"How to Create a Custom View for System Restore Events in Event Viewer?","author":"Ramesh","date":"March 4, 2016","format":false,"excerpt":"System Restore errors and informational events are logged in the Application event log. With hundreds of other entries added to the Application log every day, inspecting the System Restore events is time-consuming. Every time the user needs to use \"Filter the current log\" option to display only the System Restore\u2026","rel":"","context":"In &quot;Windows&quot;","block_context":{"text":"Windows","link":"https:\/\/www.winhelponline.com\/blog\/category\/microsoft\/windows\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/w10\/w10-custom-view-1.png?resize=350%2C200&ssl=1","width":350,"height":200},"classes":[]},{"id":1437,"url":"https:\/\/www.winhelponline.com\/blog\/mpcmdrun-signature-update-and-quickscan-one-go\/","url_meta":{"origin":19493,"position":4},"title":"How to Update Microsoft Defender and Run a Quick Scan in One Go","author":"Ramesh","date":"January 17, 2016","format":false,"excerpt":"The Microsoft Defender command-line utility MpCmdRun.exe is mostly used to schedule scans and update the definitions. The MpCmdRun.exe command usage info can be obtained by running MpCmdRun.exe with \"\/?\" or without any parameter. However, it doesn't mention a useful switch that updates Defender signatures and runs a Quick Scan at\u2026","rel":"","context":"In &quot;Windows 10&quot;","block_context":{"text":"Windows 10","link":"https:\/\/www.winhelponline.com\/blog\/category\/microsoft\/windows\/windows-10\/"},"img":{"alt_text":"windows defender scan event log","src":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2016\/01\/defender-scan-event-log.png?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2016\/01\/defender-scan-event-log.png?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2016\/01\/defender-scan-event-log.png?resize=525%2C300&ssl=1 1.5x"},"classes":[]},{"id":31098,"url":"https:\/\/www.winhelponline.com\/blog\/collect-diagnostic-logs-windows\/","url_meta":{"origin":19493,"position":5},"title":"How to Collect Diagnostic Logs in Windows","author":"Ramesh","date":"December 21, 2022","format":false,"excerpt":"There are many different types of diagnostic logs in Windows. Each log is to diagnose a specific component. The Windows Update client creates the Windows Update ETL or Windows Update log files, the Component-Based Servicing uses \"cbs.log\", and the DISM tool writes to \"dism.log\", etc. Besides the native logs, you\u2026","rel":"","context":"In &quot;Utilities&quot;","block_context":{"text":"Utilities","link":"https:\/\/www.winhelponline.com\/blog\/category\/utilities\/"},"img":{"alt_text":"Farbar Recovery Scan Tool - FRST - FRST64.exe","src":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2022\/12\/farbar.png?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2022\/12\/farbar.png?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2022\/12\/farbar.png?resize=525%2C300&ssl=1 1.5x"},"classes":[]}],"_links":{"self":[{"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/posts\/19493","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/comments?post=19493"}],"version-history":[{"count":0,"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/posts\/19493\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/media?parent=19493"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/categories?post=19493"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/tags?post=19493"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}