"delayed" event viewer?

[MK]

My event viewer seems to be "one session" late in showing system events.
I start my system, open Event Viewer, clear the system events list, keep the
program running on my dual screen to be able to detect events in real time.
Nothing appears while I work for a few hours; eventually I shut down.
The day after, as soon as I launch Event Vewer, I can see a few system
events which date and time refer to the day before.

Anyone knowing the reason for this behaviour?

Thanks

 

[*Vanguard*]

"MK" said in news:[email protected]:

My event viewer seems to be "one session" late in showing system
events.
I start my system, open Event Viewer, clear the system events list,
keep the program running on my dual screen to be able to detect
events in real time. Nothing appears while I work for a few hours;
eventually I shut down.
The day after, as soon as I launch Event Vewer, I can see a few system
events which date and time refer to the day before.

Anyone knowing the reason for this behaviour?

Thanks

Have you used the Action -> Refresh menu (which also means you must have
a log category selected, not the root node in the tree, to have Refresh
shown in the Action menu)? You can also right-click on a log type node
to select Refresh. I don't recall that it performs a scheduled
automatic refresh.

 

[CWatters]

I don't recall that it performs a scheduled automatic refresh.

It must have somewhere and I would expect it to be the default - my log is
always uptodate and I've never changed any settings in this area.

 

[Wesley Vogel]

From Event Viewer HELP:

[[When you open a log, Event Viewer displays the current information for the
log. While you view the log, the information is not updated unless you
refresh it. If you switch to another log and then return to the first log,
the first log is automatically refreshed.]]

 

[*Vanguard*]

"CWatters" said in news:%[email protected]:

It must have somewhere and I would expect it to be the default - my
log is always uptodate and I've never changed any settings in this
area.

See Wesley's response. The Event Viewer is just a *GUI* application to
let you peek at the logfiles. When you use Notepad to open a text file,
that doesn't prevent another process from still writing to that file but
obviously Notepad never gets updated. It continues showing the copy of
the file it opened, not the current contents. Same will happen when you
use regedit.exe: after making a change in one hive tree that is really a
copy of the same key in the real hive, you have to Refresh to make sure
your continued search doesn't show an old value from the memory copy.

The *real* .evt logfiles are under %windir%\system32\config. You can
even open other saved event logfiles by using the Action -> Open Log
File menu (so you could get someone else's logs to look at them at your
convenience on your host).

 

[MK]

I thank for your kind answers but, maybe due to my poor english, I have not
yet understood whether the refresh can be automatically up to date or not.
I well understand that while a file is open it can be updated by other
applications and need to be reloaded in order to show the changes; I
supposed Event Viewer was meant to do exactly that.
Are you telling me for sure that such a behaviour is not possible?

Thanks again

 

[*Vanguard*]

"MK" said in news:[email protected]:

I thank for your kind answers but, maybe due to my poor english, I
have not yet understood whether the refresh can be automatically up
to date or not. I well understand that while a file is open it can be
updated by other applications and need to be reloaded in order to
show the changes; I supposed Event Viewer was meant to do exactly
that.
Are you telling me for sure that such a behaviour is not possible?

Thanks again

Yeah, it would be possible, but the problem could be that you would lose
some events you were previously reviewing. Then the complaint would be
that old events are disappearing or the list of events keeps bouncing
around or scrolling and makes it impossible to target or click on a
moving item in the list.