Method 1: Export EVTX with Display Information (MetaData)
Note: An .evtx file must be exported with the Display Information so that events from sources can be read on other machines. Failure to include the Display Information may delay the investigation of the support case.
Export .evtx with Display Information:
- Open Event Viewer (eventvwr.msc).
- Locate the log to be exported in the left-hand column.
- Right-click the name of the log and select Save All Events As…
- Include in the file name the log type and the server name.
For example, Application_HV01 would represent the Application event log from a server named HV01.
- From the Save as type sector, select Event Files.
- Include display information.
- Be sure to include the LocaleMetaData folder when packaging logs for upload.
Store all exported EVTX files and the LocaleMetaData folder in a single ZIP or 7z archive for each machine and attach them to the support case.