Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am part of an internal software development group for an enterprise. We are being asked to build an Active Directory management web application. 1 of the primary reasons is the need to generate audit logs for operations that users do such as creating/deleteing objects, updating attributes, adding/removing members, etc.

My initial position is that all this functionality is already available in so many tools, such as the active directory users and groups snap in, why not just report on the domain controller logs and call it a day.

My understanding is that the domain control logs everything to the event log. Due to the amount of entries, our logs have a 2 day or so retention window, and because of the vast types of operations being logged getting the specific events we want is almost like finding a needle in a haystack.

Rather than building an application just so we can include our own audit logging in it, is there configuration or reporting that we can employ on the domain controller to make the audit logging more usable?

share|improve this question
add comment

1 Answer

up vote 2 down vote accepted

I find that Microsoft's LogParser works well for retrieving audit logging from my domain controllers event logs.

I use LogParser to retrieve the events from Anton Chuvakin's Critical Log Review Checklist into an SQL database, and from there can manipulate the data into the format that I need for reporting. You can also use LogParser to run the SQL queries directly against the log files, but as you only keep the logs for two days unless you're creating daily point in time reports that may not be as useful.

share|improve this answer
    
It is my understanding that the logs are kept for 2 days. Apparently that is about 64MB worth of data. do the event logs have a physical size limit or performance wise? –  Jeremy Nov 8 '11 at 18:27
    
Any performance implications with LogParse if the log is very large. –  Jeremy Nov 8 '11 at 18:31
    
@Jeremy: The size of the event logs is configurable and yes, parsing a large event log can have a performance impact. –  joeqwerty Nov 9 '11 at 2:52
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.