There are two ways you can copy and post the Event Viewer errors -
One is by clicking on the error then on Copy/Copy Details as text.
I get a lot of Schannel errors and using this method it comes out like this -
Log Name: System
Source: Schannel
Date: 06/08/2015 04:49:21
Event ID: 36888
Task Category: None
Level: Error
Keywords:
User: SYSTEM
Computer:
Description:
The following fatal alert was generated: 10. The internal error state is 10.
Event Xml:
<Event xmlns="
http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Schannel" Guid="{1F678132-5938-4686-9FDC-C8FF68F15C85}" />
<EventID>36888</EventID>
<Version>0</Version>
<Level>2</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x8000000000000000</Keywords>
<TimeCreated SystemTime="2015-08-06T03:49:21.353889000Z" />
<EventRecordID>276763</EventRecordID>
<Correlation />
<Execution ProcessID="612" ThreadID="660" />
<Channel>System</Channel>
<Computer>Tom26-TOSH</Computer>
<Security UserID="S-1-5-18" />
</System>
<EventData>
<Data Name="AlertDesc">10</Data>
<Data Name="ErrorState">10</Data>
</EventData>
</Event>
For me anything after Description is a waste as I can Google that, the Source and the Event ID.
A neater way is to use Copy/Copy Table which comes out like -
Error 06/08/2015 04:49:21 Schannel 36888 None
Where you can list all of the recent ones without taking up unnecessary space, unless Shane can make use of the additional info the first method produces.
