I need to monitor an exchange server but I don't need the provider SID microsoft-windows-security-auditing 4658 which tells me an exchange event has occurred with no detail, the detail is in an XML file which LEM cannot access (without using Log Binder) so is of no value to me
