The reason I want to do that is to duplicate a list of monitored events
(catalogued from Windows NT/2000/2003) as closely as possible for
Win7/2008R2. I can find most of the new sources and event ids (if any) in
technet, but unless these are Security errors, there is really no way of
telling which new logfile to monitor.
As an example, I found that backup events are now logged to the logfile
Applications and Service Logs/Microsoft/Windows/Backup/Operational instead of
the Application logfile, due to a reference in
http://technet.microsoft.com/en-us/library/dd364798(WS.10).aspx. But not
many of the technet event listings have this.
Any advice is appreciated.