An administrator has set up audit logging but needs to diagnose, trace, and filter for a specific user during peak period of system usage. How can this be done?