Skip to main content

How to force Netwrix Auditor to collect a specific Applications and Services event log?

When creating a new filter for Event Log Manager, you can select the log name from the drop-down list or enter the name of any custom log. In order to get the log name, please do the following:

  1. On the server where the log is located, start Event Viewer and navigate to the desired event log.
  2. Right click on it and select Log Properties.
  3. On the Properties window, copy Full Name of the event log.

![EventViewer - select desired log]./../0-images/ka04u000000HcPp_0EM700000005DIQ.png)

  1. Paste that name to the Event Log field of the filter:

![image.png]./../0-images/ka04u000000HcPp_0EM4u000007qsVK.png)