HOW TO filter event log to show some events and not others

someone suggested post here. sorry type font below. pasted in , there's no way fix it.

trying use xml filter security event log show user logon events, except don't want see "system" majority of entries. don't know why there log of system logging onto itself. that's not i'm looking for. example:

<querylist>
  <query id="0" path="security">
    <select path="security">
         *[system[(eventid=4624)]]
        and
        *[eventdata[data[@name='targetusername'] , (data ='system')]]
    </select>
  </query>
</querylist>

gives results include <eventdata> entries like

<data name="targetusername">system</data>

data !='system' supposed filter out according someone, it's not. there reason accepts this, not consider != mean not equals???? clues? there way not equals?

another example:

<querylist>
  <query id="0" path="file://c:\scripts\temp\dns server.evtx">
    <select path="file://c:\scripts\temp\dns server.evtx">
    *[eventdata[data ='mydomain.net']]
     </select>
  </query>
</querylist>

this show me events make reference mydomain.net. but, want exclude ones specify ip address 10.0.0.1 or whatever. there way excludes of kind of thing or windows event log? know has never been possible in past. but, possibility seems tantalizingly close , logs generating ten thousand events day, event logs pretty useless without knowing how due astronomical noise information ratio. , unfortunately, in ways microsoft made eventvwr.msc harder use used be.

please, if know of program can used review , query event logs without learning new computer language, post here.

hi,

you use supressor that:

<querylist>   <query id="0" path="security">     <select path="security">*</select>     <suppress path="security">*[system[(eventid=4624)]] , *[eventdata[data[@name='targetusername'] , (data ='system')]]</suppress>	   </query> </querylist>

http://msdn.microsoft.com/en-us/library/windows/desktop/dd996910%28v=vs.85%29.aspx

regards,

Windows Server  >  Management