LISTING 1: Sample Log Parser Command

logparser "select EventID, TimeWritten, Message from security where
   (EventID  = 675 and EXTRACT_TOKEN(Strings,4,'|')='0x18') or
   (EventID = 681 and EXTRACT_TOKEN(Strings,3,'|')='0xC000006A')
   order by EventID, TimeWritten"