How to Create a Custom View for System Restore Events in Event Viewer?

System Restore errors and informational events are logged in the Application event log. With hundreds of other entries added to the Application log every day, inspecting the System Restore events is time-consuming. Every time the user needs to use "Filter the current log" option to display only the System Restore entries, and then clear the filter once the entries are checked. Easier option would be to create a Custom View that lists only the System Restore entries, and this post tells you how.

Start Event Viewer, and click Create Custom View… in the Actions pane.

Configure the Custom View dialog as in the image below, and click OK.

  • Event level: All event levels checked. To only view entries that need your action, uncheck "Information" and enable all others.
  • By log: Application
  • By Source: System Restore. For a thorough analysis, you may want to include VSS entries as well.



This creates a custom System Restore view listed under Custom Views category.

Under Applications and Service Logs > Microsoft > Windows, separate logs are maintained by each application/service; but there isn’t a separate log for System Restore… which is where the Custom View option comes in handy.


One small request: If you liked this post, please share this?

One "tiny" share from you would seriously help a lot with the growth of this blog. Some great suggestions:
  • Pin it!
  • Share it to your favorite blog + Facebook, Reddit
  • Tweet it!
So thank you so much for your support. It won't take more than 10 seconds of your time. The share buttons are right below. :)

Ramesh Srinivasan is passionate about Microsoft technologies and he has been a consecutive ten-time recipient of the Microsoft Most Valuable Professional award in the Windows Shell/Desktop Experience category, from 2003 to 2012. He loves to troubleshoot and write about Windows. Ramesh founded Winhelponline.com in 2005.

2 thoughts on “How to Create a Custom View for System Restore Events in Event Viewer?”

Leave a Reply