1

A manager has asked me to log the start and stop times and dates when a user launches a particular program (Starcraft II). I have enabled logging on the user's machine so that it will report all process creation and termination. (Windows Logs -> Security)

I am unable to filter the logs to show "only" the process creation and termination of the specified programs.

The Process Creation information as follows.

NewProcessId 0xc10 
  NewProcessName C:\Program Files (x86)\StarCraft II\StarCraft II.exe 
  TokenElevationType %%1936 
  ProcessId 0xa70 

NewProcessId 0xf18 
  NewProcessName C:\Program Files (x86)\StarCraft II\Support\SC2Switcher.exe 
  TokenElevationType %%1936 
  ProcessId 0xc10 

NewProcessId 0x1a0c 
  NewProcessName C:\Program Files (x86)\StarCraft II\Versions\Base16605\SC2.exe 
  TokenElevationType %%1936 
  ProcessId 0xf18 

The Process Termination uses the same ProcessId info.

What XML Query will yield "only" the logs in question?

This is all on a Windows 7 environment.

2 Answers 2

0

If you're not averse to a bit of PowerShell, give this a go. It will drop a CSV file you can play with in Excel in the current directory.

Get-EventLog Security -ComputerName RemotePC | ?{$_.Message -ilike '*StarCraft*'} | Export-Csv SecurityLog.csv

You can also add extra conditions like so:

Get-EventLog Security -ComputerName RemotePC | ?{$_.Message -ilike '*StarCraft*' -or $_.Message -ilike '*Something Else*'} | Export-Csv SecurityLog.csv

5
  • Using the first bit of code you supplied I get a empty csv file. I also tried your second option adding "SC2" instead of "something else" which returned an empty csv file as well. If you have any other ideas, please let me know. I'll keep trying with powershell as this is my first time using it and I could use the practice.
    – Bugat
    Oct 27, 2010 at 11:47
  • That suggests to me the search is not returning any results because there are no entries that match. If you look at the event viewer on the machine, is it definitely logging these events? If you omit the end | Export-Csv SecurityLog.csv it will display on screen, which is useful to see what you're getting (if anything). Oct 27, 2010 at 11:59
  • I can verify that it is actually logging to the event viewer. I had to go one by one to find processid data which is why I decided to look for a more efficient route. Removing the export portion of the command IS spitting out results. Not sure why it isn't able to write them to a file though.
    – Bugat
    Oct 28, 2010 at 15:58
  • How odd. Did you have permission to write to the folder your PowerShell prompt was at? Mine defaults to C:/Users/Ben and I always cd Desktop just to be certain. Maybe try running PowerShell as admin as a test? Oct 28, 2010 at 17:01
  • I have the proper permissions and it generates the securitylog.csv file, the file itself is empty though. I can even redirect it elsewhere like c:\SecurityLog.csv with the same result.
    – Bugat
    Oct 28, 2010 at 19:15
2

Microsoft xpath expressions do not seem to support filtering on values with attributes. Down deep in the XML the containerization looks like this:

[EventID]
   [Data Name="NewProcessName"]"C:\Program Files (x86)\StarCraft II\StarCraft II.exe"[/Data]
[/EventID]

The problem is that Microsoft XPath expressions can't specify equality for the value of that field. It can test exists, but equality is beyond it.

Perhaps it can I haven't dug it out. At any rate, this may help:

<QueryList>
<Query Id="0" Path="Security">
<Select Path="Security">*[EventData[Data[@Name="NewProcessName"]] and System[(EventID=4688)]]</Select>
</Query>
</QueryList>

1
  • The problem I continue to have using this format is that it always returns no results. Not sure why you can't use the actual process name in the xml query.
    – Bugat
    Oct 27, 2010 at 11:36

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .