Twice Shell

[ EDITING: FileServer.Events.xml ]

<ViewerConfig>
    <QueryConfig>
        <QueryParams>
            <UserQuery />
        </QueryParams>
        <QueryNode>
            <Name ResourceId="%windir%\system32\svrmgrnc.dll,-412">File Server</Name>
            <Description ResourceId="%windir%\system32\svrmgrnc.dll,-413">System events for File Server</Description>
            <SuppressQueryExecutionErrors>1</SuppressQueryExecutionErrors>
            <QueryList>
                <Query>
                    
                    
                    <Select Path="System">*[System[Provider[@Name='DataScrn']]]</Select>
                    <Select Path="System">*[System[Provider[@Name='Quota']]]</Select>
                    <Select Path="Application">*[System[Provider[@Name='SrmSvc']]]</Select>
                    <Select Path="Application">*[System[Provider[@Name='SrmReports']]]</Select>

<Select Path="System">*[System[Provider[@Name='Microsoft-Windows-DfsSvc']]]</Select>

<Select Path="DFS Replication">*[System[Provider[@Name='DFS Replication']]]</Select>
                    <Select Path="DFS Replication">*[System[Provider[@Name='DFSR']]]</Select>

<Select Path="File Replication Service">*[System[Provider[@Name='File Replication Service']]]</Select>
                    <Select Path="File Replication Service">*[System[Provider[@Name='NtFrs']]]</Select>

<Select Path="Microsoft-Windows-ServicesForNFS-Portmapper/Admin">*[System[Provider[@Name='NfsServer' or @Name='Portmap' or @Name='Microsoft-Windows-ServicesForNFS-NFSServerService' or @Name='Microsoft-Windows-ServicesForNFS-Portmapper' or @Name='Microsoft-Windows-ServicesForNFS-Server']]]</Select>
                    <Select Path="Microsoft-Windows-ServicesForNFS-Server/Admin">*[System[Provider[@Name='NfsServer' or @Name='Portmap' or @Name='Microsoft-Windows-ServicesForNFS-NFSServerService' or @Name='Microsoft-Windows-ServicesForNFS-Portmapper' or @Name='Microsoft-Windows-ServicesForNFS-Server']]]</Select>
                    <Select Path="Microsoft-Windows-ServicesForNFS-Server/Analytic">*[System[Provider[@Name='NfsServer' or @Name='Portmap' or @Name='Microsoft-Windows-ServicesForNFS-NFSServerService' or @Name='Microsoft-Windows-ServicesForNFS-Portmapper' or @Name='Microsoft-Windows-ServicesForNFS-Server']]]</Select>
                    <Select Path="Microsoft-Windows-ServicesForNFS-Server/IdentityMapping">*[System[Provider[@Name='NfsServer' or @Name='Portmap' or @Name='Microsoft-Windows-ServicesForNFS-NFSServerService' or @Name='Microsoft-Windows-ServicesForNFS-Portmapper' or @Name='Microsoft-Windows-ServicesForNFS-Server']]]</Select>
                    <Select Path="Microsoft-Windows-ServicesForNFS-Server/Notifications">*[System[Provider[@Name='NfsServer' or @Name='Portmap' or @Name='Microsoft-Windows-ServicesForNFS-NFSServerService' or @Name='Microsoft-Windows-ServicesForNFS-Portmapper' or @Name='Microsoft-Windows-ServicesForNFS-Server']]]</Select>
                    <Select Path="Microsoft-Windows-ServicesForNFS-Server/Operational">*[System[Provider[@Name='NfsServer' or @Name='Portmap' or @Name='Microsoft-Windows-ServicesForNFS-NFSServerService' or @Name='Microsoft-Windows-ServicesForNFS-Portmapper' or @Name='Microsoft-Windows-ServicesForNFS-Server']]]</Select>
                    <Select Path="System">*[System[Provider[@Name='NfsServer' or @Name='Portmap' or @Name='Microsoft-Windows-ServicesForNFS-NFSServerService' or @Name='Microsoft-Windows-ServicesForNFS-Portmapper' or @Name='Microsoft-Windows-ServicesForNFS-Server']]]</Select>
                    <Select Path="Application">*[System[Provider[@Name='NfsSvc']]]</Select>

<Select Path="System">*[System[Provider[@Name='SIS']]]</Select>
                    <Select Path="Application">*[System[Provider[@Name='Groveler']]]</Select>

<Select Path="Application">*[System[Provider[@Name='Ci']]]</Select>

<Select Path="Application">*[System[Provider[@Name='Microsoft-Windows-Search']]]</Select>
                    <Select Path="Application">*[System[Provider[@Name='Microsoft-Windows-Search-ProfileNotify']]]</Select>

<Select Path="System">*[System[Provider[@Name='partmgr']]]</Select>
                    <Select Path="System">*[System[Provider[@Name='volmgr']]]</Select>
                    <Select Path="System">*[System[Provider[@Name='Virtual Disk Service']]]</Select>
                    <Select Path="System">*[System[Provider[@Name='VDS Basic Provider 1.0']]]</Select>
                    <Select Path="System">*[System[Provider[@Name='VDS Dynamic Provider 2.0']]]</Select>

<Select Path="System">*[System[Provider[@Name='Volsnap']]]</Select>
                    <Select Path="Application">*[System[Provider[@Name='VSS']]]</Select>

<Select Path="System">*[System[Provider[@Name='Ntfs']]]</Select>

<Select Path="Microsoft-Windows-ResumeKeyFilter/Analytic">*[System[Provider[@Name='Microsoft-Windows-ResumeKeyFilter' or @Name='Microsoft-Windows-SMBClient' or @Name='Microsoft-Windows-SmbServer' or @Name='Microsoft-Windows-SMBWitnessClient' or @Name='Microsoft-Windows-SMBWitnessService']]]</Select>
                    <Select Path="Microsoft-Windows-ResumeKeyFilter/Operational">*[System[Provider[@Name='Microsoft-Windows-ResumeKeyFilter' or @Name='Microsoft-Windows-SMBClient' or @Name='Microsoft-Windows-SmbServer' or @Name='Microsoft-Windows-SMBWitnessClient' or @Name='Microsoft-Windows-SMBWitnessService']]]</Select>
                    <Select Path="Microsoft-Windows-ResumeKeyFilter/Performance">*[System[Provider[@Name='Microsoft-Windows-ResumeKeyFilter' or @Name='Microsoft-Windows-SMBClient' or @Name='Microsoft-Windows-SmbServer' or @Name='Microsoft-Windows-SMBWitnessClient' or @Name='Microsoft-Windows-SMBWitnessService']]]</Select>
                    <Select Path="Microsoft-Windows-SMBClient/HelperClassDiagnostic">*[System[Provider[@Name='Microsoft-Windows-ResumeKeyFilter' or @Name='Microsoft-Windows-SMBClient' or @Name='Microsoft-Windows-SmbServer' or @Name='Microsoft-Windows-SMBWitnessClient' or @Name='Microsoft-Windows-SMBWitnessService']]]</Select>
                    <Select Path="Microsoft-Windows-SMBClient/ObjectStateDiagnostic">*[System[Provider[@Name='Microsoft-Windows-ResumeKeyFilter' or @Name='Microsoft-Windows-SMBClient' or @Name='Microsoft-Windows-SmbServer' or @Name='Microsoft-Windows-SMBWitnessClient' or @Name='Microsoft-Windows-SMBWitnessService']]]</Select>
                    <Select Path="Microsoft-Windows-SMBClient/Operational">*[System[Provider[@Name='Microsoft-Windows-ResumeKeyFilter' or @Name='Microsoft-Windows-SMBClient' or @Name='Microsoft-Windows-SmbServer' or @Name='Microsoft-Windows-SMBWitnessClient' or @Name='Microsoft-Windows-SMBWitnessService']]]</Select>
                    <Select Path="WitnessClientAdmin">*[System[Provider[@Name='Microsoft-Windows-ResumeKeyFilter' or @Name='Microsoft-Windows-SMBClient' or @Name='Microsoft-Windows-SmbServer' or @Name='Microsoft-Windows-SMBWitnessClient' or @Name='Microsoft-Windows-SMBWitnessService']]]</Select>
                    <Select Path="WitnessServiceAdmin">*[System[Provider[@Name='Microsoft-Windows-ResumeKeyFilter' or @Name='Microsoft-Windows-SMBClient' or @Name='Microsoft-Windows-SmbServer' or @Name='Microsoft-Windows-SMBWitnessClient' or @Name='Microsoft-Windows-SMBWitnessService']]]</Select>
                    <Select Path="System">*[System[Provider[@Name='mrxsmb']]]</Select>
                    <Select Path="System">*[System[Provider[@Name='Srv']]]</Select>
                    <Select Path="System">*[System[Provider[@Name='Srv2']]]</Select>
                    <Select Path="System">*[System[Provider[@Name='Workstation']]]</Select>
                    <Select Path="System">*[System[Provider[@Name='Server']]]</Select>

<Select Path="Application">*[System[Provider[@Name='Microsoft-Windows-Defrag']]]</Select>

<Select Path="Application">*[System[Provider[@Name='Chkdsk']]]</Select>

<Select Path="Microsoft-Windows-FailoverClustering/Operational">*[System[Provider[@Name='Microsoft-Windows-FailoverClustering']]]</Select>
                    <Select Path="Microsoft-Windows-FailoverClustering/Performance-CSV">*[System[Provider[@Name='Microsoft-Windows-FailoverClustering']]]</Select>
                    <Select Path="System">*[System[Provider[@Name='Microsoft-Windows-FailoverClustering']]]</Select>

<Select Path="Microsoft-Windows-iSCSITarget-Service/Admin">*[System[Provider[@Name='Microsoft-Windows-iSCSITarget-Service']]]</Select>
                    <Select Path="Microsoft-Windows-iSCSITarget-Service/Diagnostic">*[System[Provider[@Name='Microsoft-Windows-iSCSITarget-Service']]]</Select>
                    <Select Path="Microsoft-Windows-iSCSITarget-Service/Operational">*[System[Provider[@Name='Microsoft-Windows-iSCSITarget-Service']]]</Select>

<Select Path="Microsoft-Windows-SyncShare/Operational">*[System[Provider[@Name='Microsoft-Windows-SyncShare']]]</Select>

</Query>
            </QueryList>
        </QueryNode>
    </QueryConfig>
</ViewerConfig>

[ CLOSE ]

TWICE

[ EDITING: FileServer.Events.xml ]