Loging Server Process V2

<ViewerConfig>

<QueryConfig>

<QueryParams>

<UserQuery />

</QueryParams>

<QueryNode>

<Name LanguageNeutralValue="Device Manager - TOSHIBA MSFT NORB USB Device">Device Manager - TOSHIBA MSFT NORB USB Device</Name>

<QueryList>

<Query Id="0" Path="Microsoft-Windows-Kernel-PnP/Configuration">

<Select Path="Microsoft-Windows-Kernel-PnP/Configuration">*[System/Provider[@Name='Microsoft-Windows-Kernel-PnP'] and EventData/Data[@Name='DeviceInstanceID']='USBSTOR\DISK&amp;VEN_TOSHIBA&amp;PROD_MSFT_NORB&amp;REV_PMAP\07088914C2907143&amp;0']</Select>

<Select Path="System">*[System/Provider[@Name='Microsoft-Windows-UserPnp'] and UserData/*/DeviceInstanceID='USBSTOR\DISK&amp;VEN_TOSHIBA&amp;PROD_MSFT_NORB&amp;REV_PMAP\07088914C2907143&amp;0']</Select>

</Query>

</QueryList>

</QueryNode>

</QueryConfig>

<ResultsConfig>

<Columns>

<Column Name="Level" Type="System.String" Path="Event/System/Level" Visible="">176</Column>

<Column Name="Keywords" Type="System.String" Path="Event/System/Keywords">70</Column>

<Column Name="Date and Time" Type="System.DateTime" Path="Event/System/TimeCreated/@SystemTime" Visible="">226</Column>

<Column Name="Source" Type="System.String" Path="Event/System/Provider/@Name" Visible="">136</Column>

<Column Name="Event ID" Type="System.UInt32" Path="Event/System/EventID" Visible="">136</Column>

<Column Name="Task Category" Type="System.String" Path="Event/System/Task" Visible="">137</Column>

<Column Name="User" Type="System.String" Path="Event/System/Security/@UserID">50</Column>

<Column Name="Operational Code" Type="System.String" Path="Event/System/Opcode">110</Column>

<Column Name="Log" Type="System.String" Path="Event/System/Channel">80</Column>

<Column Name="Computer" Type="System.String" Path="Event/System/Computer">170</Column>

<Column Name="Process ID" Type="System.UInt32" Path="Event/System/Execution/@ProcessID">70</Column>

<Column Name="Thread ID" Type="System.UInt32" Path="Event/System/Execution/@ThreadID">70</Column>

<Column Name="Processor ID" Type="System.UInt32" Path="Event/System/Execution/@ProcessorID">90</Column>

<Column Name="Session ID" Type="System.UInt32" Path="Event/System/Execution/@SessionID">70</Column>

<Column Name="Kernel Time" Type="System.UInt32" Path="Event/System/Execution/@KernelTime">80</Column>

<Column Name="User Time" Type="System.UInt32" Path="Event/System/Execution/@UserTime">70</Column>

<Column Name="Processor

...