Skip to content

Instantly share code, notes, and snippets.

@rayterrill

rayterrill/EventLogQuery_SQLServer_forGrayLog

Created May 6, 2017 17:52
Show Gist options
  • Save rayterrill/887a11440f74d124b5be4bf2df8bcddb to your computer and use it in GitHub Desktop.
Save rayterrill/887a11440f74d124b5be4bf2df8bcddb to your computer and use it in GitHub Desktop.
Download ZIP
Raw
EventLogQuery_SQLServer_forGrayLog
<QueryList>\
<Query Id="0" Path="Application">\
<Select Path="Application">*[System[Provider[@Name='MSSQLSERVER' or @Name='MSSQLSERVER$AUDIT']]]</Select>\
<Suppress Path="Application">*[System[(EventID=852 or EventID=958 or EventID=3014 or EventID=3197 or EventID=3198 or EventID=3406 or EventID=3407 or EventID=3408 or EventID=3421 or EventID=3454 or EventID=6253 or EventID=6290 or EventID=6299 or EventID=8128 or EventID=9666 or EventID=9688 or EventID=9724 or EventID=10981 or EventID=15268 or EventID=17069 or EventID=17101)]]</Suppress>\
<Suppress Path="Application">*[System[(EventID=17103 or EventID=17104 or EventID=17110 or EventID=17111 or EventID=17115 or EventID=17117 or EventID=17118 or EventID=17125 or EventID=17126 or EventID=17135 or EventID=17136 or EventID=17137 or EventID=17147 or EventID=17152 or EventID=17162 or EventID=17164 or EventID=17176 or EventID=17177 or EventID=17201 or EventID=17573)]]</Suppress>\
<Suppress Path="Application">*[System[(EventID=17663 or EventID=17811 or EventID=18264 or EventID=18265 or EventID=18496 or EventID=19030 or EventID=26013 or EventID=26022 or EventID=26048 or EventID=26067 or EventID=26076 or EventID=33090 or EventID=33217 or EventID=33218 or EventID=49903 or EventID=49904 or EventID=49912 or EventID=49916 or EventID=49917)]]</Suppress>\
</Query>\
</QueryList>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment