Default config of Windows Event Logs Inadequate. What are alternatives?

Greetings and Thank you for Your Help  :-)

I am the server manager.  I need to ensure the safety of my servers, and i want to easily find events that will tell what has happened over the weekend.  I want to ensure my logs will be safe no matter what (not just on another drive on the same machine, and not just backedup at midnight ---- I want them on another machine (a very secure machine) each hour or perhaps even DIRECTLY logged there.

I'm not interested in log parser, and yes, I do have auditing jacked up to log most things.  Note that I have not asked any question about FWs, IDS, or other security measures.  I'm mainly interested in logging what happens.

What are my options?  What are the pros/cons?  Can you get eventlogs to log directly to another machine?  Is there some software (turnkey) for all this?

Thanks again so very much!,
K

ksuchyAsked:
Who is Participating?
 
wfcraven12Connect With a Mentor Commented:
you could try this.

go into regedit & find all the entries (which i think there are just two) that point to where the .Evt files are located (should be something like %systemroot\sytem32\config).  Change the path to a mapped drive to something out on the network that's secure.  definitely try it on a test machine.  i just tried it on one of mine & it seemed okay at first glance.
0
 
McKnifeConnect With a Mentor Commented:
There are two ways I favor: Use snare (intersectalliance.com) and a syslog server (kiwi or snare server). This would enable you to forward each event in realtime to another server.
The other would be to back it up using the following script: http://www.experts-exchange.com/OS/Microsoft_Operating_Systems/Server/2003_Server/Q_22451747.html
0
 
wfcraven12Commented:
CoccoBill - that was already posted.  Look at first comment.
0
 
CoccoBillCommented:
Yes, wfcraven12, I noticed. I just filled in the blanks in your post.
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.