We are using ntevl probe to monitor the security log for type:10 interactive logins. The probe alerts fine on the expression trigger. But we are trying to get a daily list of all the interactive logins that occur in a report format. When you set QOS you only get a number of times its occured. How do you get the user names to be stored so this information can be reported on?