Solved

Default config of Windows Event Logs Inadequate.  What are alternatives?

Posted on 2007-11-29
5
230 Views
Last Modified: 2013-12-06
Greetings and Thank you for Your Help  :-)

I am the server manager.  I need to ensure the safety of my servers, and i want to easily find events that will tell what has happened over the weekend.  I want to ensure my logs will be safe no matter what (not just on another drive on the same machine, and not just backedup at midnight ---- I want them on another machine (a very secure machine) each hour or perhaps even DIRECTLY logged there.

I'm not interested in log parser, and yes, I do have auditing jacked up to log most things.  Note that I have not asked any question about FWs, IDS, or other security measures.  I'm mainly interested in logging what happens.

What are my options?  What are the pros/cons?  Can you get eventlogs to log directly to another machine?  Is there some software (turnkey) for all this?

Thanks again so very much!,
K

0
Comment
Question by:ksuchy
  • 2
  • 2
5 Comments
 
LVL 8

Accepted Solution

by:
wfcraven12 earned 225 total points
ID: 20377322
you could try this.

go into regedit & find all the entries (which i think there are just two) that point to where the .Evt files are located (should be something like %systemroot\sytem32\config).  Change the path to a mapped drive to something out on the network that's secure.  definitely try it on a test machine.  i just tried it on one of mine & it seemed okay at first glance.
0
 
LVL 53

Assisted Solution

by:McKnife
McKnife earned 225 total points
ID: 20377926
There are two ways I favor: Use snare (intersectalliance.com) and a syslog server (kiwi or snare server). This would enable you to forward each event in realtime to another server.
The other would be to back it up using the following script: http://www.experts-exchange.com/OS/Microsoft_Operating_Systems/Server/2003_Server/Q_22451747.html
0
 
LVL 19

Assisted Solution

by:CoccoBill
CoccoBill earned 50 total points
ID: 20380802
0
 
LVL 8

Expert Comment

by:wfcraven12
ID: 20381058
CoccoBill - that was already posted.  Look at first comment.
0
 
LVL 19

Expert Comment

by:CoccoBill
ID: 20381092
Yes, wfcraven12, I noticed. I just filled in the blanks in your post.
0

Featured Post

New! My Passport Wireless Pro Wi-Fi Mobile Storage

Portable wireless storage to offload, edit, and stream anywhere.

High-capacity, wireless mobile storage designed to accompany professional photographers and videographers in the field to easily offload, edit and stream captured photos and high-definition videos.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
Permission issue? 10 61
Windows 10 4 39
M2 drive not showing up 16 101
Allowing a local account for incoming Rdp but not outgoing Rdp 15 109
AWS Glacier is Amazons cheapest storage option and is their answer to a ‘Cold’ storage service.  Customers primarily use this service for archival purposes and storage of infrastructure backups.  Its unlimited storage potential and low storage cost …
OfficeMate Freezes on login or does not load after login credentials are input.
This video teaches viewers how to encrypt an external drive that requires a password to read and edit the drive. All tasks are done in Disk Utility. Plug in the external drive you wish to encrypt: Make sure all previous data on the drive has been …
In this tutorial you'll learn about bandwidth monitoring with flows and packet sniffing with our network monitoring solution PRTG Network Monitor (https://www.paessler.com/prtg). If you're interested in additional methods for monitoring bandwidt…

910 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

16 Experts available now in Live!

Get 1:1 Help Now