how do I query the Security log using the WMI event log template

[Guest]

It seems to default to the System event log

I've tried Logfile="Security" in the where clause but didnt get anything. I took it out of the where clause and I got the events from the system event log.

I put a statement in the where clause such as EventCode="7036" and I do get the 7036 events so I'm doing that right

any ideas

[cmccullough]

Re: how do I query the Security log using the WMI event log template

I believe the System events are just the first to show up. If you sort on the Logfile column you should see the others. As far as Security events, find the computer you are searching in Hyena's left window, expand it, then expand Events. Double-click on Security and see if any events show up.

[Guest]

Re: how do I query the Security log using the WMI event log template

Yes, it showed there are security events to see.

I'm thinking maybe I got my WMI WHERE query wrong. Logfile="Security"

[cmccullough]

Re: how do I query the Security log using the WMI event log template

That worked for me. Make sure you don't have a typo or anything.