<ViewerConfig><QueryConfig><QueryParams><Simple><Channel>Application,Security,System,ACEEventLog,HardwareEvents,Internet Explorer,Key Management Service,Media Center,Microsoft-Windows-Dhcp-Client/Admin,Microsoft-Windows-DhcpNap/Admin,Microsoft-Windows-Dhcpv6-Client/Admin,Microsoft-Windows-Diagnosis-Scripted/Admin,Microsoft-Windows-Kernel-EventTracing/Admin,Microsoft-Windows-MUI/Admin,Microsoft-Windows-PrintService/Admin,Microsoft-Windows-RemoteApp and Desktop Connections/Admin,Microsoft-Windows-RemoteAssistance/Admin,Microsoft-Windows-TerminalServices-LocalSessionManager/Admin,Microsoft-Windows-TerminalServices-RemoteConnectionManager/Admin,Microsoft-Windows-WindowsBackup/ActionCenter,OAlerts,Windows PowerShell</Channel><Level>1,2,3</Level></Simple></QueryParams><QueryNode><Name>Události správy</Name><Description>Kritické události, chyby a varování ze všech protokolů pro správu</Description><QueryList><Query Id="0" Path="Application"><Select Path="Application">*[System[Level=1  or Level=2 or Level=3]]</Select><Select Path="Security">*[System[Level=1  or Level=2 or Level=3]]</Select><Select Path="System">*[System[Level=1  or Level=2 or Level=3]]</Select><Select Path="ACEEventLog">*[System[Level=1  or Level=2 or Level=3]]</Select><Select Path="HardwareEvents">*[System[Level=1  or Level=2 or Level=3]]</Select><Select Path="Internet Explorer">*[System[Level=1  or Level=2 or Level=3]]</Select><Select Path="Key Management Service">*[System[Level=1  or Level=2 or Level=3]]</Select><Select Path="Media Center">*[System[Level=1  or Level=2 or Level=3]]</Select><Select Path="Microsoft-Windows-Dhcp-Client/Admin">*[System[Level=1  or Level=2 or Level=3]]</Select><Select Path="Microsoft-Windows-DhcpNap/Admin">*[System[Level=1  or Level=2 or Level=3]]</Select><Select Path="Microsoft-Windows-Dhcpv6-Client/Admin">*[System[Level=1  or Level=2 or Level=3]]</Select><Select Path="Microsoft-Windows-Diagnosis-Scripted/Admin">*[System[Level=1  or Level=2 or Level=3]]</Select><Select Path="Microsoft-Windows-Kernel-EventTracing/Admin">*[System[Level=1  or Level=2 or Level=3]]</Select><Select Path="Microsoft-Windows-MUI/Admin">*[System[Level=1  or Level=2 or Level=3]]</Select><Select Path="Microsoft-Windows-PrintService/Admin">*[System[Level=1  or Level=2 or Level=3]]</Select><Select Path="Microsoft-Windows-RemoteApp and Desktop Connections/Admin">*[System[Level=1  or Level=2 or Level=3]]</Select><Select Path="Microsoft-Windows-RemoteAssistance/Admin">*[System[Level=1  or Level=2 or Level=3]]</Select><Select Path="Microsoft-Windows-TerminalServices-LocalSessionManager/Admin">*[System[Level=1  or Level=2 or Level=3]]</Select><Select Path="Microsoft-Windows-TerminalServices-RemoteConnectionManager/Admin">*[System[Level=1  or Level=2 or Level=3]]</Select><Select Path="Microsoft-Windows-WindowsBackup/ActionCenter">*[System[Level=1  or Level=2 or Level=3]]</Select><Select Path="OAlerts">*[System[Level=1  or Level=2 or Level=3]]</Select><Select Path="Windows PowerShell">*[System[Level=1  or Level=2 or Level=3]]</Select></Query></QueryList></QueryNode></QueryConfig><ResultsConfig><Columns><Column Name="Úroveň" Type="System.String" Path="Event/System/Level" Visible="">190</Column><Column Name="Klíčová slova" Type="System.String" Path="Event/System/Keywords">70</Column><Column Name="Datum a čas" Type="System.DateTime" Path="Event/System/TimeCreated/@SystemTime" Visible="">240</Column><Column Name="Zdroj" Type="System.String" Path="Event/System/Provider/@Name" Visible="">150</Column><Column Name="ID události" Type="System.UInt32" Path="Event/System/EventID" Visible="">150</Column><Column Name="Kategorie úlohy" Type="System.String" Path="Event/System/Task" Visible="">151</Column><Column Name="Uživatel" Type="System.String" Path="Event/System/Security/@UserID">50</Column><Column Name="Kód operace" Type="System.String" Path="Event/System/Opcode">110</Column><Column Name="Protokol" Type="System.String" Path="Event/System/Channel">80</Column><Column Name="Počítač" Type="System.String" Path="Event/System/Computer">170</Column><Column Name="ID procesu" Type="System.UInt32" Path="Event/System/Execution/@ProcessID">70</Column><Column Name="ID posloupnosti" Type="System.UInt32" Path="Event/System/Execution/@ThreadID">70</Column><Column Name="ID procesoru" Type="System.UInt32" Path="Event/System/Execution/@ProcessorID">90</Column><Column Name="ID relace" Type="System.UInt32" Path="Event/System/Execution/@SessionID">70</Column><Column Name="Čas jádra" Type="System.UInt32" Path="Event/System/Execution/@KernelTime">80</Column><Column Name="Čas uživatele" Type="System.UInt32" Path="Event/System/Execution/@UserTime">70</Column><Column Name="Doba procesoru" Type="System.UInt32" Path="Event/System/Execution/@ProcessorTime">100</Column><Column Name="ID korelace" Type="System.Guid" Path="Event/System/Correlation/@ActivityID">85</Column><Column Name="ID relativní korelace" Type="System.Guid" Path="Event/System/Correlation/@RelatedActivityID">140</Column><Column Name="Název zdroje události" Type="System.String" Path="Event/System/Provider/@EventSourceName">140</Column></Columns></ResultsConfig></ViewerConfig>