I'm trying to analyze the logs of my 2 servers, one Win 2k8 R2 and the other Win 2k3. Specifically, I would like to be able to see in the logs if a user deleted, accessed, or modified either the Security Event or System Event logs. I found this link that has an event code for when a log is cleared, and was wondering if there was some way to see if a log was accessed through Event Viewer. I haven't been able to find a code for simply accessing these logs through Event Viewer. And as far as I am aware, a user should not be able to modify the contents of this two log files other than clearing them, correct? Just to be clear, I want to know if a user is in Event Viewer and looking through these audit logs.