Unable to reset Eventlog Filters on Windows 2003 Server

Question

After clearing the event log files on one of our Windows Server 2003 servers I noticed that the filter parameters have not been reset to All Records. In fact the last From date is 31 May 2013. I can reset it to Default then it displays all records. The
log files get stored and reset at the end of every month but these parameters will not change. I have disable the EventLog service and delete the EVT files, rebooted the server and reset the Eventlog Service to Automatic and restarted the service but the filter
paramets remain unchanged. I have looked in the registry but cannot identify where these parameters are held and there does not appear to be a specific INI file that stroes this information. Where to now?

Answer 1

Hi Colin,
>>After clearing the event log files on one of our Windows Server 2003 servers I noticed that the filter parameters have not been reset to All Records
As far as I know, to turn off event filtering, we need to click
All Records on the View menu.
Besides, filtering changes only the view, and has no effect on the actual contents of the log. All events are logged continuously, whether the filter is active or not. If
you archive a log from a filtered view, all records are saved, even if you select a text format or comma-delimited text format file.
Regarding filtering events, the following article can be referred to for more information.
Filter events
http://technet.microsoft.com/en-us/library/cc778482(v=ws.10).aspx
Best regards,
Frank Shen