Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a web application that runs on Windows Server (some 2003, some 2008).

I want to log system events (e.g. someone from IP address X successfully logged in remotely via remote desktop to this computer, or system user Bob added file abc.exe or changed permissions on file log.txt)

Two questions

  1. How do people usually log these system events as I described in Windows Server 2003/2008?

  2. Assuming I have several different servers, and I also have application specific logging done at the application layer (and possibly other things like load balancer logs, etc), I am now stuck with several different log files (possibly in different formats) across multiple servers. What tools/methods do people use to manage this data?

share|improve this question
up vote 2 down vote accepted
  1. System events are logged into windows eventlog. To log file access and manipulation, you will probably need to enable auditing.
  2. You should probably set up centralized logging using a tool such as snare agent or similar. There is also splunk.
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.