Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a web application that runs on Windows Server (some 2003, some 2008).

I want to log system events (e.g. someone from IP address X successfully logged in remotely via remote desktop to this computer, or system user Bob added file abc.exe or changed permissions on file log.txt)

Two questions

  1. How do people usually log these system events as I described in Windows Server 2003/2008?

  2. Assuming I have several different servers, and I also have application specific logging done at the application layer (and possibly other things like load balancer logs, etc), I am now stuck with several different log files (possibly in different formats) across multiple servers. What tools/methods do people use to manage this data?

share|improve this question

1 Answer 1

up vote 2 down vote accepted
  1. System events are logged into windows eventlog. To log file access and manipulation, you will probably need to enable auditing.
  2. You should probably set up centralized logging using a tool such as snare agent or similar. There is also splunk.
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.