Iis – How to filter Event Viewer down to errors from a single website

EDIT: To answer your edited question, the easiest way I can think of is to sort your Event Log by Event ID, select everything except the events you want to exclude and then Save Selected Events to file. It will save as a single Event Log file, which you can then open with your Event Viewer, and won't have the events you didn't select.

Powershell's another option, especially if you want to do that for a large number of Event Logs, but I don't have an "exclude Event ID" PS script handy, so I'm not going to punch it up unless you ask nicely.

And the now not-quite relevant original answer is below.

Yes, it's pretty easy, but a little different depending on what version of Windows you're using.

Images below.

In 2008 or Windows 7:

In 2003 or XP:

You can even use PowerShell to parse your EventLogs for you based on any number of factors... but the built in filters are pretty good.

Try this:

<QueryList>
  <Query Id="0" Path="Security">
    <Select Path="Security">*[System[(EventID=4608)]]</Select>
    <Suppress Path="Security">*[EventData[Data[@Name="TargetUserSid"] = "S-1-5-18"]]</Suppress>
  </Query>
</QueryList>