Tell me more ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
up vote 2 down vote favorite
6

We have a collection of about 100 Windows 2003 and Windows 2008 R2 domain controllers that I would like to start capturing Event Log data from. Many of the servers are very busy and generate large volumes of events, particularly security events that we also want to capture.

We're currently using a enterprise/expensive monitoring solution that we're reasonably happy with for system uptime and performance statistics, but the event log monitoring component is not so good.

I'm hoping to find something quick and dirty for this purpose if possible.

share|improve this question

5 Answers

up vote 3 down vote accepted

If already have some Linux/Unix machines in your environment and are comfortable with that format, I'd recommend using Syslog. There are a number of products that will forward your logs to a syslog server for you.

If you're just looking for log collection for legal/compliance reasons, anything will do, really.

Splunk is fairly popular log tool (I think it's based on syslog) that can do a lot of reporting for you. If you want analytics built in, it's a good place to start evaluating. It has a limited free version, but can pay to break out of those limitations.

You can also use Nagios to assist you with your Log Management, especially with some of the plugins and sidecar applications, but I'll warn that it's not trivial to set up.

UPDATE: If you're not afraid of scripting, there are a lot of examples of Logging Scripts at the Microsoft Script Center Repository. (Fulfilling the down-n-dirty requirement...)

share|improve this answer
2  
There's a couple of good FOSS ones too such as EVTSYS, developed by Purdue: code.google.com/p/eventlog-to-syslog – gravyface Sep 14 '10 at 12:33
Nice, GravyFace! +1 to you – gWaldo Sep 14 '10 at 12:53
I accepted this one because I'd actually like to get some IT value out of this thing. Splunk stands out there, so I'll check it out. – duffbeer703 Sep 14 '10 at 16:30
up vote 4 down vote

SCOM (System Center Operations Manager) or anotehr enterprise tool just is it. Nothing else.

2008 R2 can forward events to another server out of the box, allowing central archiving, but that rules out definitely the 2003 servers.

share|improve this answer
1  
I think we'll be heading in the SCOM direction in the next couple of years. Unfortunately, we inherited a large single-label domain that isn't compatible. – duffbeer703 Sep 14 '10 at 12:24
up vote 3 down vote

You may want to give a try to Splunk to collect and index all these events. Splunk provide a very efficient way of visualizing, correlating datas from various inputs including Windows Event Logs.

share|improve this answer
up vote 1 down vote

Quick and dirty, you say? Here you go:

http://www.logmeister.com/index.shtml

share|improve this answer
up vote 1 down vote

phpLogCon might help you here (although it's more about reading/browsing the logs than collecting them). I've only ever used it with rsyslog, but the documentation says:

The database can be populated by MonitorWare Agent, WinSyslog or EventReporter on the Windows side and by rsyslog on the Unix/Linux side.

(It would probably be worth looking into these tools.)

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.