Re: Managing Windows Event Logs

Just to add my $.02:

I'm using perl to do my log management. I have a much smaller network, but I would imagine that it should scale pretty well.

In addition, for ad hoc (and other analysis), I highly recommend MS' Log Parser tool. It takes SQL-like queries against a number of log formats and is easy to use.

http://www.microsoft.com/windows2000/downloads/tools/logparser/default.asp

There's an upgrade as well:

http://www.microsoft.com/windows2000/downloads/tools/logparser21/default.as p

but you have to download the entire IIS 6 RK Tools to get it.

Greg

Do you need help?

In addition to our free technical library, Pantek provides professional IT services to companies who utilize Open Source software: Learn more about Pantek's Technical Support offerings Place an order for 24/7/365 Technical Support here Learn more about Pantek, who we are, and what we do Chat with a Live Operator Related securityfocus.com Links bugtraq certification focus-bsd focus-ids focus-ih focus-linux focus-ms focus-sun focus-unix-other focus-virus forensics incidents libnet linux-secnews ms-secnews pen-test secpapers secprog sectools secureshell security-basics securityjobs sf-news vuln-dev webappsec Request more information about Pantek