How to create targeted discard rules for recurring Windows events in Log Analyzer

Recurring Windows netprofm events can create excessive log volume in Log Analyzer. Use targeted rules based on the event ID, message content, and—when appropriate—the source IP address instead of a broad Windows error-level rule.

A rule matching all Windows events with Level = Error may also discard unrelated Windows errors that are important for monitoring and troubleshooting.

1. Keep any broad rule using Vendor = Windows and Level = Error disabled.

2. Open Log Viewer, click Settings, expand Windows Events under Processing Policies, select My Custom Rules, and click Create. Log Analyzer supports custom conditions and actions for Windows event processing.

3. Create a rule for Event ID 7001 with conditions that match all of the following:

   • Vendor: Windows
   • Level: Error
   • Event ID: 7001
   • Message contains: Network List Service
   • IP Address: Add the relevant source IP addresses when filtering should apply only to specific servers.

4. Create a separate rule for Event ID 10005 with conditions that match all of the following:

   • Vendor: Windows
   • Level: Error
   • Event ID: 10005
   • Message contains: netprofm
   • IP Address: Add the relevant source IP addresses when required.

   The case used separate rules with event ID, message content, and IP address conditions to target the intended events.

5. For each rule, add these actions:

   • Flag for discard
   • Stop processing rules

   Flag for discard prevents the matching event from being saved to the database, while Stop processing rules prevents additional rules from processing that event.

6. Place the targeted rules above any broader rules in the processing order. Log Analyzer displays rule execution order in the rules list, and rule order can be changed from the Processing tab.

7. Enable the Event ID 7001 rule first and monitor Log Viewer for 15–30 minutes. Confirm that the intended events are no longer stored while unrelated Windows Error events continue to appear.

8. Enable the Event ID 10005 rule and repeat the same validation. If additional servers generate these events, add their IP addresses to the existing rules rather than creating unnecessary duplicate rules.

NOTE: These rules only control how matching events are processed and stored in Log Analyzer. They do not stop Windows from generating the underlying events. If the events must remain available for operational or compliance purposes, consider tagging them instead of discarding them.