Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a server running Windows Server 2008.

I'm using Windows Server Auditing to check when and by which user a folder is modified to determine who is modifying it as the modifications are causing problems.

I can see the log of the audit when a change is made in the System log.

How do I create a Custom View that will return all events from System log where a certain text (which is the folder name) is present? The create custom view doesn't seem to have that option.

I'm not sure whether it's possible via custom xml query or whether I'll need to export the system log to csv and search in Excel.

share|improve this question
    
User powershell a simple powershell "get-eventlog security| select message | select-string "baduser"" . Powershell and eventlogs work quite well together. Also logparser is a very good tool also. –  tony roth Apr 2 '12 at 14:12

1 Answer 1

up vote 1 down vote accepted

I've found the program Event Log Explorer which suits my needs.

You can find it here: http://www.eventlogxp.com/

It allows to filter by a search term which is sufficient for me.

share|improve this answer
1  
You may also enjoy Microsoft's Log Parser, although command-line, it is incredibly versatile. –  jscott May 18 '12 at 11:08

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.