• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 252
  • Last Modified:

Default config of Windows Event Logs Inadequate. What are alternatives?

Greetings and Thank you for Your Help  :-)

I am the server manager.  I need to ensure the safety of my servers, and i want to easily find events that will tell what has happened over the weekend.  I want to ensure my logs will be safe no matter what (not just on another drive on the same machine, and not just backedup at midnight ---- I want them on another machine (a very secure machine) each hour or perhaps even DIRECTLY logged there.

I'm not interested in log parser, and yes, I do have auditing jacked up to log most things.  Note that I have not asked any question about FWs, IDS, or other security measures.  I'm mainly interested in logging what happens.

What are my options?  What are the pros/cons?  Can you get eventlogs to log directly to another machine?  Is there some software (turnkey) for all this?

Thanks again so very much!,

  • 2
  • 2
3 Solutions
you could try this.

go into regedit & find all the entries (which i think there are just two) that point to where the .Evt files are located (should be something like %systemroot\sytem32\config).  Change the path to a mapped drive to something out on the network that's secure.  definitely try it on a test machine.  i just tried it on one of mine & it seemed okay at first glance.
There are two ways I favor: Use snare (intersectalliance.com) and a syslog server (kiwi or snare server). This would enable you to forward each event in realtime to another server.
The other would be to back it up using the following script: http://www.experts-exchange.com/OS/Microsoft_Operating_Systems/Server/2003_Server/Q_22451747.html
CoccoBill - that was already posted.  Look at first comment.
Yes, wfcraven12, I noticed. I just filled in the blanks in your post.
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Featured Post

Free Tool: Site Down Detector

Helpful to verify reports of your own downtime, or to double check a downed website you are trying to access.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

  • 2
  • 2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now