Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Do I need a third party tool for this?

share|improve this question
2  
Me too. Only evil things come to mind. –  Stu Thompson May 14 '09 at 19:20
1  
I have a request for this, too. For example: RDP has some problems with one of my printers. It shows up in the App log with a big fat X which is then picked up ALL OVER (especially on domain controllers, e.g. dcdiag etc.) and causes WAY more problems. Maybe the better question is: how to suppress logging of certain types of errors? –  Matt Rogish May 14 '09 at 19:26
2  
Evil, ha. I had an app accidentally write messages which were causing problems with a notification service. –  JC. May 14 '09 at 19:30
2  
@Matt Rogish the way to suppress logging of a certain type of error is to fix the error. The fact that it's logging some problem is indicating that something is wrong that should be fixed, and not a friendly reminder to fill your car up with gas. –  mrTomahawk May 14 '09 at 19:30
1  
@Matt - The printer error in RDP is because you have printer sharing ticket on your RDP client, which it is by default. Simplest way to fix the problem is to un-tick the box. The problem occurs because the machine your connecting to can't find the drivers for the printer since it is not a normal printer share. –  Diago May 14 '09 at 21:29
show 5 more comments

5 Answers

up vote 8 down vote accepted

Microsoft purposely prevents you from doing this. The whole concept of the Event Viewer is to present to you certain events that may require your attention. If one could go in and delete any old random event, then the system could in a sense be compromised without you knowing, therefor making it unsafe. If you are having an event logged that is and error....find out what is causing the problem and fix it. You don't want to patch a hole in a dam by sticking a wad gum in the hole. If something is logging informational or caution events too much, then many times the event log source (either Microsoft or a third-party) has some setting that indicates how often or to what level of logging to configure for an application. And that is where you go to minimize the logging, not by doing surgery on the event log.

share|improve this answer
1  
Only an administrator should be able to access logs, and if a malicious user has acquired administrative privileges to your box then you're already f'd. –  bamccaig Sep 16 '13 at 18:20
add comment

The OP's post if valid. The number one problem with logging, error reporting, and alerting is white noise. When too many "errors" are reported and most of them are low priority or of no concern at all, administrators tend to ignore ALL errors. Good or bad, this is just a fact of life.

One of the errors he is talking about is (I think) event ID 1111. It simply means that you have a printer mapped with a driver that is not available on the server to which you are connected. It is an error of no concern in most cases ... there is nothing to "fix" as it is not a problem.

If you want to find actual problems and you have specific event ID's that you don't care to weed through, create a custom view with the following steps ...

  1. In your event log click on "Filter Current Log" in the action pane.
  2. About half way down the dialog box that pops up, you will find a text box with
  3. Replace this text with your filter needs. If you want only a certain event, put that event ID in there. If you have multiples, use commas to separate. If you wish to exclude, use a minus sign. In this case we would use "-1111" (without the quotes of course).
  4. Click "OK" on the dialog box.
  5. In the action pane you now click "Save Filter to Custom View".

Now when you wish to look at your event log, use your custom view and only the information you are truly concerned with will be displayed.

I know that this is a late post to a dead thread but hopefully it helps someone else who is Googling this more than posts of "[Working as intended, n00b!]" ;-)

share|improve this answer
2  
That's filtering, not removing. You gave a great (and useful) answer to a question that wasn't asked, to be honest. –  mfinni Mar 22 '11 at 15:00
add comment

The only thing you can do in Windows is clear the whole log. I only found one third party app that claims to do this -Winzapper, however I have never used it and it states it is for NT and 2000 so I do not know if it will work for server 2003/2008. Be aware that there is potential for corruption of the Event log when using these, so tread carfeully.

share|improve this answer
add comment

You can write a .net application to delete event log and event source.

Example source code as below:

class Program
{
    static void Main(string[] args)
    {
        System.Diagnostics.EventLog.DeleteEventSource("YourEventSourceName");
        System.Diagnostics.EventLog.Delete("YourEventName");
    }
}

Reference: http://msdn.microsoft.com/en-us/library/system.diagnostics.eventlog(v=vs.100).aspx

share|improve this answer
    
How can I clear ALL entries Application event log?, not delete Application event log, only the entries –  Kiquenet Jun 5 at 7:15
add comment

What might solve your problem is to change the audit policies in group policy. Without knowing what specifically you want to not show up, I'm not sure if there's a setting for it, but here's an example.

In GPMC, drill down through Computer Configuration - Windows Settings - Security Settings - Local Policies - Audit Policy. There's not a TON of granularity here, but maybe you can get rid of what's filling up your logs. (My DCs aren't 2008, so this is what I've got from a 2003 AD perspective, hopefully it's not completely different)

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.