<ViewerConfig><QueryConfig><QueryParams><Simple><BySource>True</BySource><Channel>Application,Microsoft-Windows-HttpService/Trace,Security,System</Channel><Source>Active Server Pages,ASP.NET 2.0.50727.0,HostableWebCore,Microsoft-Windows-HttpEvent,Microsoft-Windows-HttpService,Microsoft-Windows-IIS-APPHOSTSVC,Microsoft-Windows-IIS-FTP,Microsoft-Windows-IIS-IISManager,Microsoft-Windows-IIS-IisMetabaseAudit,Microsoft-Windows-IIS-IISReset,IISInfoCtrs,IISLOG,IIS-METABASE,Microsoft-Windows-IIS-W3SVC,Microsoft-Windows-IIS-W3SVC-PerfCounters,Microsoft-Windows-IIS-W3SVC-WP,Microsoft-Windows-IIS-WMSVC,Microsoft-Windows-WAS,Microsoft-Windows-WAS-ListenerAdapter,WDEPLOY</Source><RelativeTimeInfo>0</RelativeTimeInfo></Simple></QueryParams><QueryNode><Name>IIS Events</Name><Description>IIS Events</Description><QueryList><Query Id="0" Path="Application"><Select Path="Application">*[System[Provider[@Name='Active Server Pages' or @Name='ASP.NET 2.0.50727.0' or @Name='HostableWebCore' or @Name='Microsoft-Windows-HttpEvent' or @Name='Microsoft-Windows-HttpService' or @Name='Microsoft-Windows-IIS-APPHOSTSVC' or @Name='Microsoft-Windows-IIS-FTP' or @Name='Microsoft-Windows-IIS-IISManager' or @Name='Microsoft-Windows-IIS-IisMetabaseAudit' or @Name='Microsoft-Windows-IIS-IISReset' or @Name='IISInfoCtrs' or @Name='IISLOG' or @Name='IIS-METABASE' or @Name='Microsoft-Windows-IIS-W3SVC' or @Name='Microsoft-Windows-IIS-W3SVC-PerfCounters' or @Name='Microsoft-Windows-IIS-W3SVC-WP' or @Name='Microsoft-Windows-IIS-WMSVC' or @Name='Microsoft-Windows-WAS' or @Name='Microsoft-Windows-WAS-ListenerAdapter' or @Name='WDEPLOY']]]</Select><Select Path="Microsoft-Windows-HttpService/Trace">*[System[Provider[@Name='Active Server Pages' or @Name='ASP.NET 2.0.50727.0' or @Name='HostableWebCore' or @Name='Microsoft-Windows-HttpEvent' or @Name='Microsoft-Windows-HttpService' or @Name='Microsoft-Windows-IIS-APPHOSTSVC' or @Name='Microsoft-Windows-IIS-FTP' or @Name='Microsoft-Windows-IIS-IISManager' or @Name='Microsoft-Windows-IIS-IisMetabaseAudit' or @Name='Microsoft-Windows-IIS-IISReset' or @Name='IISInfoCtrs' or @Name='IISLOG' or @Name='IIS-METABASE' or @Name='Microsoft-Windows-IIS-W3SVC' or @Name='Microsoft-Windows-IIS-W3SVC-PerfCounters' or @Name='Microsoft-Windows-IIS-W3SVC-WP' or @Name='Microsoft-Windows-IIS-WMSVC' or @Name='Microsoft-Windows-WAS' or @Name='Microsoft-Windows-WAS-ListenerAdapter' or @Name='WDEPLOY']]]</Select><Select Path="Security">*[System[Provider[@Name='Active Server Pages' or @Name='ASP.NET 2.0.50727.0' or @Name='HostableWebCore' or @Name='Microsoft-Windows-HttpEvent' or @Name='Microsoft-Windows-HttpService' or @Name='Microsoft-Windows-IIS-APPHOSTSVC' or @Name='Microsoft-Windows-IIS-FTP' or @Name='Microsoft-Windows-IIS-IISManager' or @Name='Microsoft-Windows-IIS-IisMetabaseAudit' or @Name='Microsoft-Windows-IIS-IISReset' or @Name='IISInfoCtrs' or @Name='IISLOG' or @Name='IIS-METABASE' or @Name='Microsoft-Windows-IIS-W3SVC' or @Name='Microsoft-Windows-IIS-W3SVC-PerfCounters' or @Name='Microsoft-Windows-IIS-W3SVC-WP' or @Name='Microsoft-Windows-IIS-WMSVC' or @Name='Microsoft-Windows-WAS' or @Name='Microsoft-Windows-WAS-ListenerAdapter' or @Name='WDEPLOY']]]</Select><Select Path="System">*[System[Provider[@Name='Active Server Pages' or @Name='ASP.NET 2.0.50727.0' or @Name='HostableWebCore' or @Name='Microsoft-Windows-HttpEvent' or @Name='Microsoft-Windows-HttpService' or @Name='Microsoft-Windows-IIS-APPHOSTSVC' or @Name='Microsoft-Windows-IIS-FTP' or @Name='Microsoft-Windows-IIS-IISManager' or @Name='Microsoft-Windows-IIS-IisMetabaseAudit' or @Name='Microsoft-Windows-IIS-IISReset' or @Name='IISInfoCtrs' or @Name='IISLOG' or @Name='IIS-METABASE' or @Name='Microsoft-Windows-IIS-W3SVC' or @Name='Microsoft-Windows-IIS-W3SVC-PerfCounters' or @Name='Microsoft-Windows-IIS-W3SVC-WP' or @Name='Microsoft-Windows-IIS-WMSVC' or @Name='Microsoft-Windows-WAS' or @Name='Microsoft-Windows-WAS-ListenerAdapter' or @Name='WDEPLOY']]]</Select></Query></QueryList></QueryNode></QueryConfig><ResultsConfig><Columns><Column Name="Level" Type="System.String" Path="Event/System/Level" Visible="">241</Column><Column Name="Keywords" Type="System.String" Path="Event/System/Keywords">70</Column><Column Name="Date and Time" Type="System.DateTime" Path="Event/System/TimeCreated/@SystemTime" Visible="">291</Column><Column Name="Source" Type="System.String" Path="Event/System/Provider/@Name" Visible="">201</Column><Column Name="Event ID" Type="System.UInt32" Path="Event/System/EventID" Visible="">201</Column><Column Name="Task Category" Type="System.String" Path="Event/System/Task" Visible="">202</Column><Column Name="User" Type="System.String" Path="Event/System/Security/@UserID">50</Column><Column Name="Operational Code" Type="System.String" Path="Event/System/Opcode">110</Column><Column Name="Log" Type="System.String" Path="Event/System/Channel">80</Column><Column Name="Computer" Type="System.String" Path="Event/System/Computer">170</Column><Column Name="Process ID" Type="System.UInt32" Path="Event/System/Execution/@ProcessID">70</Column><Column Name="Thread ID" Type="System.UInt32" Path="Event/System/Execution/@ThreadID">70</Column><Column Name="Processor ID" Type="System.UInt32" Path="Event/System/Execution/@ProcessorID">90</Column><Column Name="Session ID" Type="System.UInt32" Path="Event/System/Execution/@SessionID">70</Column><Column Name="Kernel Time" Type="System.UInt32" Path="Event/System/Execution/@KernelTime">80</Column><Column Name="User Time" Type="System.UInt32" Path="Event/System/Execution/@UserTime">70</Column><Column Name="Processor Time" Type="System.UInt32" Path="Event/System/Execution/@ProcessorTime">100</Column><Column Name="Correlation Id" Type="System.Guid" Path="Event/System/Correlation/@ActivityID">85</Column><Column Name="Relative Correlation Id" Type="System.Guid" Path="Event/System/Correlation/@RelatedActivityID">140</Column><Column Name="Event Source Name" Type="System.String" Path="Event/System/Provider/@EventSourceName">140</Column></Columns></ResultsConfig></ViewerConfig>
