"Char Jackson" wrote in message
...
On Fri, 21 Jun 2019 08:19:49 -0400, "SC Tom" wrote:

*** I either don't have a 4802 anywhere, or I just don't know where to
look
for it :-( Too bad there's not a search function in event viewer. I tried
sorting by event ID and still no 4802, even right after the SS has kicked
in.

In event viewer, look on the right side in the Actions pane. Click on
Filter Current Log. In the
dialog that pops up, click in the field that says All Event IDs, which
will clear that text. Enter
your desired Event ID and click OK.

To clear the search and start over, click the Clear button at the lower
right corner of that dialog,
or in the Actions pane click on Clear Filter. (In the Actions pane, Clear
Filter is only available
if you actually have a filter set.)

That's a basic search. To get more granular, you can adjust the "Any Time"
field and/or the Event
level or any of the other things on that dialog. Everything you do will
restrict the output that
much more.

To get started on your first search, enter an Event ID that you can
actually see in the unfiltered
event list, just to get a feel for how it all works.

Too bad you have go to each of the 500 or so logs to search. I was kinda
hoping for a way to search all of them in one fell swoop :-)

Thanks for the info though; I'm sure it'll come in handy!
--

SC Tom