Wednesday, November 2, 2011

XML filtering within the Windows Event Viewer

Starting in the Windows Vista/Server 2008 time frame, an option was made available to modify or create a XML query to generate Custom Views within the Event Viewer.  To create a Custom View, access the Event Viewer application.  Right-click on the Custom Views subfolder and select the Create Custom View menu option.

custom_view_1

Click on the XML tab and then on the Edit query manually checkbox.  Click on the Yes button within the warning dialog box.

custom_view_2

Enter text for the XML query.  Below is some sample text to search the Security logs for the user account test:

<QueryList>
  <Query Id="0" >
    <Select Path="Security">
       *[EventData[Data[@Name='SubjectUserName'] and (Data='test')]]
     </Select>
  </Query>
</QueryList>

When finished, give the Custom View entry a name and description.

custom_view_3

Queries can include AND/OR operators.

<QueryList>
  <Query Id="0">
    <Select Path="Security">
       *[EventData[Data[@Name='SubjectUserName'] and (Data='test' or Data=’testtwo’)]]
     </Select>
  </Query>
</QueryList>

To find additional fields to query on, access the details of an event entry and click on the XML view.

custom_view_4

The query below looks for events that any data or field equals test

<QueryList>
  <Query Id="0">
    <Select Path="Security">
       *[EventData[Data and (Data='test' )]]
     </Select>
  </Query>
</QueryList>

No comments:

Post a Comment