14

The modern Event Viewer application that you get on all versions of Windows since Vista is so much slower the previous version that was on Server 2003 and XP. I know there is much more functionality in the newer version but most of the time I just want to quickly scan the various different event logs as quickly as possible. How can I get the the old version back?

Martin Hollingsworth
  • 599
  • 1
  • 4
  • 11
  • 1
    The splitting up of the application event logs actually IMO makes it easier as now I can drill down and review ONLY what I want to review. You can setup a custom view that will show up in the tree above the standard windows logs. That might make your task more speedy once it is setup. FWIW, I don't generally find it very slow, but then again, it isn't terribly quick either. Maybe you have other issues you need to address? Are your logs huge? – MikeAWood May 17 '13 at 00:42
  • It's nothing to do with the size of the logs or dividing the logs into multiple different logs. It is just the snappyness of the tool when viewing each log. I appreciate the new viewer adds support for various scenarios but I still want my primary scenario to be as good as it used to be. I found a solution to have the best of both worlds . – Martin Hollingsworth May 17 '13 at 00:48

2 Answers2

18

Helge Klein has a great blog post showing how to do add the earliar version of the MMC snapin back - How to Get Back Windows XP’s Fast Event Viewer in Windows 7.

Basically you have to run the command

regsvr32 els.dll

from an elevated privilege command prompt and it will then show up as an MMC snapin called Classic Event Viewer. I'm very happy to have found my cheese :-)

Martin Hollingsworth
  • 599
  • 1
  • 4
  • 11
  • If the cliche of sifting forums of 1,000 useless answers for just one golden idea a day, even it takes eight hours to find it, Martin's answer is the winner of the week!!!!! That tip and article helped me too and I confirmed it works on Server 2012 too. – Karen3819x4 May 17 '13 at 02:54
  • Why only worry with this is that it is missing all the application logging as well. So events that have a specific application event won't show up if the older tool is used exclusively. My concern long term would be that you would miss things that would otherwise be exposed. But very cool find and certainly a good work around if all you are going after are the regular event logs. – MikeAWood May 18 '13 at 00:32
  • didn't work for me windows 10.0.14393 – JJS Nov 12 '16 at 17:17
  • @JJS worked for me on Windows 10.0.15063 – Alex Sep 26 '18 at 08:00
  • @Alex still no lover for me - 10.0.17134.286 `The module "els.dll" was loaded but the call to DllRegisterServer failed with error code 0x80070005.` – JJS Sep 27 '18 at 13:43
7

I just want to quickly scan the various different event logs as quickly as possible.


Quickly scan Event Viewer you say... how about PowerShell:

Get-WinEvent -FilterHashtable @{logname='system'; level=2; StartTime=(Get-Date).date}

This will immediately return all Error events from the System log that occurred this day.

Want to look two days back? 

Get-WinEvent -FilterHashtable @{logname='system'; level=2; StartTime=(Get-Date).AddDays(-1).date}

How about just the Information Events generated by Outlook from the Application log?

Get-WinEvent -FilterHashtable @{logname='application'; level=4; ProviderName="Outlook"; StartTime=(Get-Date).date}

Pretty hard to beat that.

  • 3
    I'm well aware of the _power_ of PowerShell, including the CmdLets for the event log but the question was really all about restoring an existing capability. I'm all for the command line as a default but sometimes a GUI just suits the browsing scenario where you don't really know exactly what you are looking for. – Martin Hollingsworth May 17 '13 at 03:15
  • 1
    Sorry, I know it doesn't directly answer your question. I just learned about this and was excited to share. Feel free to downvote. –  May 17 '13 at 06:15
  • I actually up voted your answer as it does add to the discussion. Just not the right answer to the scenario I was interested in. Thanks anyway @kce – Martin Hollingsworth May 17 '13 at 07:07
  • The question helped me because it validated my opinion about the new event viewer -- everyone looked at me like I had two heads when I'd complain about it. Both answers were very helpful. Upvotes all around. – Dawn Benton Apr 23 '15 at 00:42
  • @DawnBenton — Maybe you *do* have two heads... have you checked recently? :-) – InteXX May 24 '17 at 23:37