Auditor Help: WMI Event Log Filter

  1. During Windows collection, from the Data Collections Options dialog box, WMI tab, click the Filter....
    WMI Filter options
  2. Choose and specify Relative Time Range or Exact Time Range for events to report or choose the Unlimited option to report all.
  3. For each log type, choose Do not collect, Collect all events or Collect only event codes (specified).
     For details and definitions, see Common 2000/2003 Auditing Event Codes.
  4. For any log that you chose to specify event codes, enter the codes to collect separated by semi-colons.
  5. Click OK.
  6. Return to Windows collection options.
  7. Proceed with network discovery.