Export Security Events

[Guest]

I use the WMI_Class "Win32_NTLogEvent" with the properties ComputerName, TimeGenereated, SourceName, EventCode, EventType, Logfile, Type, Message to export events.
I have to questions:
1. The export file only contains events from application and system.
But I also need security events. Whats wrong?
2. When I open the export file in excel sometime "message" entries are truncated over serveral rows.
Are there any options I can selecet while opening the file in excel to prevent this?

[cmccullough]

Re: Export Security Events

Try running it with a Where clause of:

Logfile="Security"

Do you get results that way?

On your other question, I believe you can simply increase the width of that column until they all fit on one row.

[Guest]

Re: Export Security Events

Then the export file is empty

[cmccullough]

Re: Export Security Events

I would have to assume this is a permissions issue or something along those lines. I can't think of any other reason for WMI to not return the data.

[Guest]

Re: Export Security Events

I try to export the log on my own computer where I´m logged in with admin rights.

Used software is:
Hyena 6.5 german
Exporter Pro 1.8

[cmccullough]

Re: Export Security Events

In Hyena, right-click on your computer and choose Events->Filter Events. Select Security and see if you can see events that way.

[Guest]

Re: Export Security Events

Yes, that works fine.

[cmccullough]

Re: Export Security Events

You'll probably need to try CIM Studio to make sure that its not a problem with WMI. You can get this from Microsoft's site.

Also, are you using Hyena or Exporter Pro to create this file? If you are using EP,
then try it with Hyena to see if there is any difference between the two.