The TMG firewall uses SQL Express 2008 to log entries regarding activities taking place on the TMG firewall. The built-in log viewer gives you a lot of control and is very flexible so that you can find just about anything you want to find using the TMG firewall’s log viewer. However, if you want to perform some operations on the log that are not supported by the log view, you can do that too.
Check out how to do this in the following article:
DEBRA LITTLEJOHN SHINDER
MVP (Enterprise Security)