MINI

C:/ProgramData/Microsoft/Event Viewer/Views/ServerRoles/
files >> C:/ProgramData/Microsoft/Event Viewer/Views/ServerRoles/FileServer.Events.xml
 <!-- Copyright (c) Microsoft Corporation.  All rights reserved. -->
<ViewerConfig>
  <QueryConfig>
    <QueryParams>
      <UserQuery />
    </QueryParams>
    <QueryNode>
      <Name ResourceId="%windir%\system32\svrmgrnc.dll,-412">File Server</Name>
      <Description ResourceId="%windir%\system32\svrmgrnc.dll,-413">System events for File Server</Description>
      <SuppressQueryExecutionErrors>1</SuppressQueryExecutionErrors>
      <QueryList>
        <Query>
<!-- FS Role optional components BEGIN -->
	<!-- FSRM events BEGIN -->		
		<Select Path="System">*[System[Provider[@Name='DataScrn']]]</Select>
		<Select Path="System">*[System[Provider[@Name='Quota']]]</Select>
		<Select Path="Application">*[System[Provider[@Name='SrmSvc']]]</Select>
		<Select Path="Application">*[System[Provider[@Name='SrmReports']]]</Select>
	<!-- FSRM events END -->

	<!-- DFS Namespaces events BEGIN -->
		<Select Path="System">*[System[Provider[@Name='Microsoft-Windows-DfsSvc']]]</Select>
	<!-- DFS Namespaces events END 	-->	

	<!-- DFS Replication events BEGIN -->
		<Select Path="DFS Replication">*[System[Provider[@Name='DFS Replication']]]</Select>
		<Select Path="DFS Replication">*[System[Provider[@Name='DFSR']]]</Select>
	<!-- DFS Replication events END -->

	<!-- NTFRS events BEGIN -->	
		<Select Path="File Replication Service">*[System[Provider[@Name='File Replication Service']]]</Select>
		<Select Path="File Replication Service">*[System[Provider[@Name='NtFrs']]]</Select>
	<!-- NTFRS events END -->

	
	<!-- NFS events BEGIN -->
		<Select Path="System">*[System[Provider[@Name='NfsSvr']]]</Select>
		<Select Path="System">*[System[Provider[@Name='Portmap']]]</Select>
		<Select Path="Application">*[System[Provider[@Name='NfsSvc']]]</Select>	
	<!-- NFS events END -->

	<!-- SIS events BEGIN -->
		<Select Path="System">*[System[Provider[@Name='SIS']]]</Select>
		<Select Path="Application">*[System[Provider[@Name='Groveler']]]</Select>			
	<!-- SIS events END -->
		
	<!-- Content Indexing events BEGIN -->	
		<Select Path="Application">*[System[Provider[@Name='Ci']]]</Select>		
	<!-- Content Indexing events END -->


	<!-- Windows Search events BEGIN -->
		<Select Path="Application">*[System[Provider[@Name='Microsoft-Windows-Search']]]</Select>		
		<Select Path="Application">*[System[Provider[@Name='Microsoft-Windows-Search-ProfileNotify']]]</Select>
	<!-- Windows Search events END -->
<!-- FS Role optional components END -->


<!-- Core components important for FS Role BEGIN -->
	<!-- VDS, VolMgr events BEGIN -->	
		<Select Path="System">*[System[Provider[@Name='partmgr']]]</Select>	
		<Select Path="System">*[System[Provider[@Name='volmgr']]]</Select>
		<Select Path="System">*[System[Provider[@Name='Virtual Disk Service']]]</Select>
		<Select Path="System">*[System[Provider[@Name='VDS Basic Provider 1.0']]]</Select>
		<Select Path="System">*[System[Provider[@Name='VDS Dynamic Provider 2.0']]]</Select>
	<!-- VDS, VolMgr events END -->

	<!-- VSS, VolSnap events BEGIN -->
		<Select Path="System">*[System[Provider[@Name='Volsnap']]]</Select>
		<Select Path="Application">*[System[Provider[@Name='VSS']]]</Select>			
	<!-- VSS, VolSnap events END -->

	<!-- NTFS, TxF, UDF, FAT, exFAT events BEGIN -->		
		<Select Path="System">*[System[Provider[@Name='Ntfs']]]</Select>
	<!-- NTFS, TxF, UDF, FAT, exFAT events END -->


	<!-- SMB events BEGIN -->
		<Select Path="System">*[System[Provider[@Name='mrxsmb']]]</Select>
		<Select Path="System">*[System[Provider[@Name='Srv']]]</Select>
		<Select Path="System">*[System[Provider[@Name='Srv2']]]</Select>
		<Select Path="System">*[System[Provider[@Name='Workstation']]]</Select>
		<Select Path="System">*[System[Provider[@Name='Server']]]</Select>		
	<!-- SMB events END -->

	<!-- Defrag events BEGIN -->	
		<Select Path="Application">*[System[Provider[@Name='Microsoft-Windows-Defrag']]]</Select>
	<!-- Defrag events END -->

	<!-- CHKDSK events BEGIN -->
		<Select Path="Application">*[System[Provider[@Name='Chkdsk']]]</Select>		
	<!-- CHKDSK events END -->

<!-- Core components important for FS Role END -->
        </Query>
      </QueryList>
    </QueryNode>
  </QueryConfig>
</ViewerConfig>