Search for Events in the Events Logging Page

Use the search and background search capabilities to view all logged events in the Event Logging page. Note that background searches can only be performed for historical events.

Procedure

Step 1

In the navigation bar, choose Events & Logs > Events > Event Logging.

Step 2

Click either the Historical or Live tab.

Step 3

Navigate to the search bar, type the search query, and click Search to execute the search.

Alternatively, click the search box to choose from a list of Sample Filters to quickly execute a search, such as search for events with access control policy rule action as Block. You can use the sample filters to quickly populate a search query in the search bar, and then modify it to match your specific needs. For more information about using the sample filters, see Use Sample Filters to Search Events.

Step 4

If you want to execute a search in the background while you move away from the search page, do the following:

  1. Choose Search in Background from the Search drop-down list.

    The search operation is queued, and you are notified once the search is completed. You are allowed to execute multiple search queries in the background.

    For more information about scheduling a background search, see Schedule a Background Search in the Event Viewer

  2. Click the Background Searches button to view the Background Searches page. From this view, you can do the following:

    • The Background Searches page displays a list of search results. You can choose to view, download, or delete the search results.

    • You can also navigate to the Notification Preferences page to view or modify your notification settings.

    • Click Start a Background Search to start a new search from this page.

What to do next

You can turn any background search into a scheduled background search if you need a recurring query. See Schedule a Background Search in the Event Viewer for more information.