Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a server running Windows Server 2008.

I'm using Windows Server Auditing to check when and by which user a folder is modified to determine who is modifying it as the modifications are causing problems.

I can see the log of the audit when a change is made in the System log.

How do I create a Custom View that will return all events from System log where a certain text (which is the folder name) is present? The create custom view doesn't seem to have that option.

I'm not sure whether it's possible via custom xml query or whether I'll need to export the system log to csv and search in Excel.

share|improve this question
User powershell a simple powershell "get-eventlog security| select message | select-string "baduser"" . Powershell and eventlogs work quite well together. Also logparser is a very good tool also. – tony roth Apr 2 '12 at 14:12
up vote 1 down vote accepted

I've found the program Event Log Explorer which suits my needs.

You can find it here:

It allows to filter by a search term which is sufficient for me.

share|improve this answer
You may also enjoy Microsoft's Log Parser, although command-line, it is incredibly versatile. – jscott May 18 '12 at 11:08

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.