For example, the command
logparser -i:EVT -resolveSIDs ON "SELECT DISTINCT SID FROM security"
might yield the results that Figure 2 shows. Similarly, you can use LogParser's RESOLVE_SID() function to translate a SID to its corresponding account name. For example, the command
logparser "SELECT DISTINCT SID, RESOLVE_SID(SID) AS username FROM security"
returns each unique SID and its corresponding username, as Figure 3 shows.
Usually, you'll want to filter output according to a field's value in relation to another value, such as whether the current record's event ID matches 529 or whether TimeGenerated is greater than or equal to a certain date. Sometimes, though, you need to know whether a field exists in a list of multiple values. In such cases, the comparison operator IN comes in handy. For example, the clause
WHERE EventID IN (529, 530, 531, 532, 533, 534, 535, 537, 539)
returns all failed logon events listed in the parentheses. By inserting a NOT in front of IN, you'd reverse the logic and tell LogParser to return records in which the event ID isn't among those listed. . . .
Register
