audit_EventTypeReadableNames ON audit_LogEntryProperties.attr_event_type = audit_EventTypeReadableNames.EventType INNER JOIN audit_LogEntryAttributes ON audit_LogEntryProperties.DeviceGuid = audit_LogEntryAttributes.DeviceGuid AND audit_LogEntryProperties.attr_seq_number = audit_LogEntryAttributes.SequenceNumber INNER JOIN audit_AttributeReadableNames ON audit_LogEntryAttributes.attrib_name = audit_AttributeReadableNames.AttributeName WHERE (audit_LogEntryProperties.attr_event_catagory = '6') and audit_LogEntryAttributes.attrib_value like @LikeExpression ORDER BY audit_LogEntryProperties.attr_datetime, audit_LogEntryProperties.DeviceGuid, audit_LogEntryProperties.attr_seq_number END GO Enter the following command line to invoke the SearchIMs procedure to search IMs that contain the string ‘contoso2’: Exec SearchIMs ‘contoso2’ This query returns all IMs containing the specified string, with the results sorted in reverse chronological order. Search for File Information Associated with User via SearchUser The following procedure returns workspace and Files tool activity for an audited user whose name matches a specified string. To create and invoke a procedure to search for a specific audited Groove user, follow these steps:
audit_EventTypeReadableNames ON audit_LogEntryProperties.attr_event_type = audit_EventTypeReadableNames.EventType INNER JOIN audit_LogEntryAttributes ON audit_LogEntryProperties.DeviceGuid = audit_LogEntryAttributes.DeviceGuid AND audit_LogEntryProperties.attr_seq_number = audit_LogEntryAttributes.SequenceNumber INNER JOIN audit_AttributeReadableNames ON audit_LogEntryAttributes.attrib_name = audit_AttributeReadableNames.AttributeName WHERE (audit_LogEntryProperties.attr_event_catagory = '6') and audit_LogEntryAttributes.attrib_value like @LikeExpression ORDER BY audit_LogEntryProperties.attr_datetime, audit_LogEntryProperties.DeviceGuid, audit_LogEntryProperties.attr_seq_number END GO Enter the following command line to invoke the SearchIMs procedure to search IMs that contain the string ‘contoso2’: Exec SearchIMs ‘contoso2’ This query returns all IMs containing the specified string, with the results sorted in reverse chronological order. Search for File Information Associated with User via SearchUser The following procedure returns workspace and Files tool activity for an audited user whose name matches a specified string. To create and invoke a procedure to search for a specific audited Groove user, follow these steps: