In the various sysinternals programs I have not been able to figure out how to start one of the tools with a filter option that will run for x number of hours and only output to a file certain error messages that I have identified. All the filtering seems to be real time. What I am thinking of are those types of situations where there is an on-again off-again type problem. Right now if I let the sysinternals tools run they will spew out endless lines of info into a file which will quickly become huge and have more in it than I want. For example, I might be looking for a specific 'File access denied' message and I want to start whateve sysinternal utility so it's already looking for that out of the message when it starts up as opposed to me starting it up and then asking for it to filter for that message.
