Event Details
User Activity->System Events->Windows 2000-2003->EventID 517 - The audit log was cleared
EventID 517 - The audit log was cleared
 Sample: 
        Event Type:     Success Audit
        Event Source:   Security
        Event Category: System Event
        Event ID:       517
        Date:           10/26/2009
        Time:           07:31:38
        User:           NT AUTHORITY\SYSTEM
        Computer:       DC1
        Description:
        The audit log was cleared

        Primary User Name:	SYSTEM
        Primary Domain:	NT AUTHORITY
        Primary Logon ID:	(0x0,0x3E7)
        Client User Name:	Alebovsky
        Client Domain:	RESEARCH
        Client Logon ID:	(0x0,0x59DF36)
Log Type: Windows Event Log
 Uniquely Identified By:
Log Name: Security
Filtering Field Equals to Value
OSVersion Windows 2000
Windows XP
Windows 2003
Category System
Source Security
EventId 517
Field Matching
FieldDescriptionStored inSample Value
When At what date and time a user activity originated in the system. DateTime
Who Account or user name under which the activity occured. Client User Name Alebovsky
What The type of activity occurred (e.g. Logon, Password Changed, etc.) "The audit log was cleared" The audit log was cleared
Where The name of the workstation/server where the activity was logged. Computer
Where From The name of the workstation/server where the activity was initiated from. - 10.10.10.10
Severity Specify the seriousness of the event. "Medium" Medium
WhoDomain Client Domain RESEARCH
WhereDomain -
Comments
You must be logged in to comment