When I create a "Logs\Event Logs" report part the "Event Type" always shows the number 4 when I run the report making this column useless.
What I'm expecting to see is a string values of "Information", "Error", "Warning", etc... (see: http://msdn.microsoft.com/en-us/library/windows/desktop/aa363662(v=vs.85).aspx)
I have a ticket open for this issue but I thought I would check and see if anybody else has this issue.
Here are the Event Type codes if anybody cares. Apparently it won't be fixed to show the string values anytime soon and these codes were not documented in the help file when I created this thread, so it might be important for those who want to make good reports...
That is just the information I was looking for. Only, these fields seem to be a string and not a numeric field. How can I filter for only Errors and Warnings. I used 2 filter rules: 'like 1' and a second rule 'like 2'. In that case also the audit failures were shown because it also starts with '1'...
Any ideas that could help in this filtering issue?
No if you do it like that then it is "like 1" and "like 2" what you need to do is "like 1, 2" the "," acts like an OR
Did not realize that they were string values.
Thanks, I forgot the ',' as an OR-function.
Now I use the following two filters and that works just great:
* LIKE 1, 2
* NOT LIKE 16
The second filter is very important, while otherwise all Audit Failures are also counted.
Thanks for this information and followup Knox. Just displaying number values only confuses the people i am delivering these reports too: the clients. Its rough that you almost have to make a Key for this report, unless you know what you are looking at.