Here's a query that is non portal specific but it should get you started.
It is a bit complex simply because of the XQuery that is used to get the TabID from the XML formated ntext. You should be able to copy and paste this into SQL Server Management Studio and run it. I include most all of the available columns from the tables, you can remove the ones you don't need.
-- Create a temporary table to store the values and convert the TabProperties field to XML type
DECLARE
@TempLog TABLE
(
IndexID int IDENTITY (1, 1) NOT NULL,
LogUserID int,
LogUserName nvarchar(200),
LogPortalID int,
LogPortalName nvarchar(200),
LogCreateDate datetime,
TabProperties xml,
LogTypeKey nvarchar(200)
)
-- Insert all of the TAB only related logs into the temp table
INSERT
INTO @TempLog (LogUserID, LogUserName, LogPortalID, LogPortalName, LogCreateDate, TabProperties, LogTypeKey)
SELECT
LogUserID, LogUserName, LogPortalID, LogPortalName, LogCreateDate, LogProperties, LogTypeKey
FROM
EventLog
WHERE
LogTypeKey LIKE 'TAB%'
ORDER
BY LogCreateDate DESC
-- Retrieve all of the results and get the additional tab information
SELECT
IndexID, LogTypeKey, LogUserID, LogUserName, LogPortalID, LogPortalName, LogCreateDate,
-- Next two fields are really optional in the output but demonstrate use of XQuery for XML and TabID is required for the JOIN below
-- Basically this is how we get the TabID from the LogProperties ntext field after it is converted to xml dbtype
(SELECT TabProperties.value('(/LogProperties/LogProperty/PropertyName)[1]', 'nvarchar(200)')) AS PropertyName,
(SELECT TabProperties.value('(/LogProperties/LogProperty/PropertyValue)[1]', 'nvarchar(200)')) AS PropertyValue,
t.TabName,
t.TabPath,
t.URL,
t.TabOrder,
t.IsVisible,
t.ParentID,
t.Level,
t.IconFile,
t.DisableLink,
t.Title,
t.Description,
t.KeyWords,
t.IsDeleted,
t.SkinSrc,
t.ContainerSrc,
t.StartDate,
t.EndDate,
t.RefreshInterval,
t.PageHeadText,
t.IsSecure
FROM @TempLog
JOIN Tabs AS t
ON (t.TabID = (SELECT TabProperties.value('(/LogProperties/LogProperty/PropertyValue)[1]', 'nvarchar(200)')))
Hope this helps.