How to query Event viewer *archives*?

[xbit]

Hello @all!

We are tracking some user activities on our Win 7 machine and the security logs are quite big. Every 20MB the Event Viewer is creating a new archive and stores it, this happens several times a day.

My problem now is how to browse those archives? As it seems, when accessing the Event Viewer, he only hands out the active part and does not search in the archives. How may I query or browse the existing archived files without loading them one by one as there are to many files?

Thanks for any hints, links or ideas!

 

[xbit]

Hm... seems to be a tough one?

I still did not found a usable way to browse more than one archive after the other... it takes a lot of time to find something. Maybe I did not understand the way it works.

Could need some ideas!
Thanks.