RE: Managing Windows Event Logs

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

I'm wondering why anyone hasn't suggested using WMI to query for WARNING and ERROR logs for the previous 24-hours or something like that? I have created a VBScript that goes out and queries computer objects within your NT/AD domain (using the WINNT provider, not the LDAP provider, but I do have an updated version of this). This script will create an HTML report that you can then go through server by server to see what event logs you need to examine.

Chris Lynch

• -----Original Message----- From: Chuck Meeusen [mailto:cmeeusen@optonline.net] Sent: Friday, June 20, 2003 1:28 PM To: focus-ms@securityfocus.com

This discussion on event logs hits home for me. I'm attempting to build a system of gathering and archiving the event logs from a number (15 at present but must scale to 30-40) of NT and 2K servers. It's not pretty.

My main source of information has been a document prepared for a SANS course called "Centralizing Event Logs on Windows 2000" by Greg Lalla. He scripts dumpevt.exe which I've found to be very effective and then bcp's the csv's into a SQL dbase.

So I'm wondering what anyone else is doing to gather logs and archive?

C.

Do you need help?

In addition to our free technical library, Pantek provides professional IT services to companies who utilize Open Source software: Learn more about Pantek's Technical Support offerings Place an order for 24/7/365 Technical Support here Learn more about Pantek, who we are, and what we do Chat with a Live Operator Related securityfocus.com Links bugtraq certification focus-bsd focus-ids focus-ih focus-linux focus-ms focus-sun focus-unix-other focus-virus forensics incidents libnet linux-secnews ms-secnews pen-test secpapers secprog sectools secureshell security-basics securityjobs sf-news vuln-dev webappsec Request more information about Pantek

-

-----BEGIN PGP SIGNATURE-----
Version: PGP 8.0
Comment: Public PGP key for Chris Lynch

iQA/AwUBPvcc3G9fg+xq5T3MEQI6OQCguHwSa3Nqdf1Iwbq01eCOhpPuAzoAn2nT v52++nbNCHwBUPhsEYmcpIX0
=2f+k
-----END PGP SIGNATURE-----