• Locked Locked
  • Replies 5 replies
  • Subscribers 14 subscribers
  • Views 6438 views
  • Users 0 members are here
Options
Related
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Creating a report for Quest Knowledge Portal on specific Event IDs

nicole.h.dodd.ctr
over 6 years ago

Good Day!

I am trying to create a report that uses the data imported from a Repo to the Audit database to report on specific Event IDs in the security logs. Is there a way to create a report where I can type in any Event ID say 1104 and pull the computer and date that the event was triggered? I have several event IDs that are being requested that are not in the report packs and wanted to know how to generate a report for them with Quest Knowledge Portal.

 

 

Any feedback is greatly appreciated!

 

Thanks,

Nicole

Parents
  • over 6 years ago

    Hi Nicole,

    Unfortunately, I cannot describe here the full technology of creating reports with parameters like this one. And if you "edit" this "Event Log Cleared" report in Report Builder you'll see it doesn't allow to launch the query designer because the query was created manually. I see 3 ways for you from this point:

    1. You may edit it manually at your own risk. Of course such simple changes can work only if events have the same structure (here 1102 and 1104):
      1. download the "Event Log Cleared" report to .rdl file
      2. change 1102 to 1104
      3. change "Event Log Was Cleared" to "Security Log Is Full"
      4. change description
      5. rename file to "Security Log Is Full.rdl"
      6. upload it to SSRS to the same folder
    2. Use Report Builder with InTrust Model to create your own report:
      1. In SSRS click "New Paginated Report"
      2. Choose Blank Report
      3. Data Sources - Add MyDataSource - Browse - InTrust 10.0 model
      4. Data Set - Add Data Set - Use embedded, specify MyDataSource
      5. Query Designer - Generic Events
      6. Add fields that you want by double click, add filters: event log equals Security, event id equals 1104
      7. Drag and drop these fields to the page and type the caption.
    3. But the recommended way is to order new reports via Quest support representative.
Reply
  • over 6 years ago

    Hi Nicole,

    Unfortunately, I cannot describe here the full technology of creating reports with parameters like this one. And if you "edit" this "Event Log Cleared" report in Report Builder you'll see it doesn't allow to launch the query designer because the query was created manually. I see 3 ways for you from this point:

    1. You may edit it manually at your own risk. Of course such simple changes can work only if events have the same structure (here 1102 and 1104):
      1. download the "Event Log Cleared" report to .rdl file
      2. change 1102 to 1104
      3. change "Event Log Was Cleared" to "Security Log Is Full"
      4. change description
      5. rename file to "Security Log Is Full.rdl"
      6. upload it to SSRS to the same folder
    2. Use Report Builder with InTrust Model to create your own report:
      1. In SSRS click "New Paginated Report"
      2. Choose Blank Report
      3. Data Sources - Add MyDataSource - Browse - InTrust 10.0 model
      4. Data Set - Add Data Set - Use embedded, specify MyDataSource
      5. Query Designer - Generic Events
      6. Add fields that you want by double click, add filters: event log equals Security, event id equals 1104
      7. Drag and drop these fields to the page and type the caption.
    3. But the recommended way is to order new reports via Quest support representative.
Children
No Data