When I'm late filling in my timesheets, it always is a headache to remember which hours I spent working. My windows event viewer (eventvwr.msc) can be a help but the logs are too crowded.
The events related to logon/logoff are polluted with plenty of events from system services.
So I ventured to create a filter only showing the events relating to my user. This requires XML filtering based on XPATH.
- Create a new custom event view
- right click the security category and select Create Custom View...
- enter the event ID's you want to filter. For logon/logoff these are 4624, 4634 and 4647
- You can get the id's by examining your events or from this MSDN page.
- Modify the base filter.
- There is a field for filtering on the user name in the filter definition form, but that did not work. By clicking the XML tab we can edit the XML filter definition. Take care: you will not be able to edit the filter using the graphical user interface anymore after that.
- I added user filtering in the XML. This is my filter
- I saved the filter and provided a name for the new custom filter.
- We're done
<QueryList> <Query Id="0" Path="Security"> <Select Path="Security"> *[System[( EventID=4624 or EventID=4634 or EventID=4647)] and EventData[Data[@Name='TargetUsername']='jan']] </Select> </Query> </QueryList>
- In eventviewer, pick a logon event of logon type 2. More info on logon events...
- Select the event and in the bottom half of the window you see the details
- Select the Details Tab, then the XML view button. This shows you the name/value pairs on which you can filter. I want to filter on my user, so I'll need the SubjectUserName field.