evt and log prequery