Tag Info

Hot answers tagged

15

With Windows 2000/Server2003/Windows XP, the logs are stored in the %SystemRoot%\System32\Config directory, with an .evt extension. With Server 2008/Vista and up, the log are stored in the %SystemRoot%\system32\winevt\logs directory, and also have an .evt extension. Within the Computer Manager you can also export them to a .txt or .csv file.


14

The OP's post if valid. The number one problem with logging, error reporting, and alerting is white noise. When too many "errors" are reported and most of them are low priority or of no concern at all, administrators tend to ignore ALL errors. Good or bad, this is just a fact of life. One of the errors he is talking about is (I think) event ID 1111. ...


11

It seems like most people don't know about this feature, but Windows will rotate the log files automatically if so-configured. Look for "AutoBackupLogFiles" in this file. You can configure this on a server-for-server basis, but that's tedious for a large number of servers. I created an Administrative Template to set this on server computers, and then ...


9

Windows Server has a built in SNMP trap generator for the Windows Event Log/Viewer, which can send traps on the occurrence of arbitrary events. Trap Form (OID) These traps will conform to the Microsoft private enterprise MIB branch in the following form: 1.3.6.1.4.1.311.1.13.X.n.n.n.n.n.n.n.n.n... Each "n" is a decimal encoding of an ASCII character ...


8

Microsoft purposely prevents you from doing this. The whole concept of the Event Viewer is to present to you certain events that may require your attention. If one could go in and delete any old random event, then the system could in a sense be compromised without you knowing, therefor making it unsafe. If you are having an event logged that is and ...


8

Take a look at IIS7's Failed Request Tracing feature: Troubleshooting Failed Requests Using Tracing in IIS 7 Troubleshoot with Failed Request Tracing The other thing I would do is tweak your <httpErrors> setting because IIS may be swallowing an error message from further up the pipeline: <configuration> <system.webServer> ...


8

All times displayed for event log events are computed as offsets to Greenwich Mean Time (GMT). When you set the time on your system, you are setting the value for GMT. When you select your local time zone for the system, the appropriate number of hours are added or subtracted to the stored GMT value. This adjusted time is displayed. When "Automatically ...


7

We can't answer that. Applications can put whatever they want into the logs; you could write a key logger that logged every keystroke on the system into the event log, or a web app that dumped every user's plaintext password into a log entry. You also haven't defined what "extremely sensitive" means to you. By default, Windows isn't logging anything that ...


7

They are gone, unless you either: Saved the logs as it suggested you do when you clicked clear Have a full system backup It's also possible but unlikely data recovery software could undelete them. They are stored in C:\Windows\System32\winevt\Logs if you want to use software like GetDataBack or similar to try to recover them.


7

Use C:\Windows\Sysnative\winevt In most cases, whenever a 32-bit application attempts to access %windir%\System32, the access is redirected to %windir%\SysWOW64. 32-bit applications can access the native system directory by substituting %windir%\Sysnative for %windir%\System32. WOW64 recognizes Sysnative as a special alias used to indicate that the file ...


7

Account lockouts can be a pain to troubleshoot. My first reccomendation would be to get the Account Lockout Tools from Microsoft. Using these tools you can figure out which of your DC's are actually locking out the account. From there you'll need to do some snooping in the security log to figure out which server is causing the lockout to happen, then you ...


6

You could do this with OSSEC, a multi-platform open-source software: OSSEC is a full platform to monitor and control your systems. It mixes together all the aspects of HIDS (host-based intrusion detection), log monitoring and SIM/SIEM together in a simple, powerful and open source solution. And for Log Monitoring/Alerting: Real-time and ...


6

It could either be that you are actually wilfully establishing more than ten connections simultaneously (the actual establishing part that is, not total connections established) or you have some malware on the system. As Izzy wrote this is supposedly a security feature to prevent malware from bogging down the system with incomplete connection attempts - so ...


6

You could use Snare for Windows, a free software (freeware), released under the terms of the GNU Public Licence (GPL). Snare for Windows Vista is a Windows 2008 and Windows Vista compatible service that interacts with the underlying "Crimson" Eventlog subsystem to facilitate remote, real-time transfer of event log information. Snare for ...


6

It may help you but this is a simple bug probably due to the still-pretty-new iLO v3 code, basically update - hope if fixes it - if not ignore and/or report to HP.


5

The only way to catch this kind of stuff is to have file-level auditing already in place. After the fact, you can't find out. That kind of auditing is horrendously spammy and pretty much requires some kind of third party log aggregation/analysis engine.


5

The event logs are a clearing-house for any messages or errors thrown by the OS, its components, and any software installed on the system. So we can't fully cover all it's potential contents because there's unlimited potential things it could contain and they all require individual treatment. One way to analyze event logs is: Filter out the informational ...


5

First I would suggest using the Get-WinEvent and passing a hash to do as much filtering as possible there (and thus avoid creating lots of objects Where-Object will throw away): Get-WinEvent -filterHashtable @{LogName='Security'; StartTime=$a; Id=4624; Level=0} Level 0 is success audit. This can be performed remotely with the -computer parameter. Then ...


5

$Event = Get-EventLog Application | ? { $_.Source -EQ 'BackupSoftware' } | Sort Time | Select -Last 1 If($Event.Time -LT (Get-Date).AddHours(-1)) { Do-Stuff } That will find the most recent event in the Application log with a Source of "BackupSoftware". $Event = Get-EventLog BackupSoftware | Sort Time | Select -Last 1 If($Event.Time -LT ...


5

You might be also interested in nxlog as it provides a wealth of features such as rfc5424 syslog format, TLS/SSL, filtering, rewrite, etc. (note: I'm affiliated with the project).


5

Audit Logon Events So I looked around and discovered you can make a group policy (and apply it to your production server OU) that can audit logon events, in other words Write an event log when people log on or off your server. To do so, Open Group Policy Management, Then create a new group policy object in the "Group Policy Objects folder" Give it a ...


5

You can try this: WECUtil SS "SubscriptionName" /cm:custom /ree:true This should be done before the Subscription is started. In other words, after you create the subscription disable it, then run the above command, then renable it. The list will then populate http://blog.zenshaze.com/2011/06/13/event-forwarding-of-security-logs/


5

You can use Attach task to this log or simply create a new scheduled task. Use the trigger When a specific event is logged Choose the log you want to monitor (you can choose multiple logs in the advanced task settings) Set the action to Send an e-mail (and provide the nescessary information) If you want any error sending a message you have to refine the ...


5

I would suggest you use OSSEC. It can agregate all the information in a single server and has a nice web interface that allows you to display the alerts.


5

A fault bucket identification number is a number assigned by the system to identify specific types of errors. This number is used by Microsoft to identify a particular program error when you send an error report. If you get a "this program has encountered a problem and needs to close" type error, click the 'Send error report' button, and you may get a ...


5

Well, you don't mention what OS you hope to run the monitoring system(s) on, so I'll assume that you don't have a preference. My favorite monitoring app is Nagios. Nagios doens't have the same level of eye candy that some of its competitors do, but what it lacks in UI, it makes up for in rock-solid stability and performance. To your point about receiving ...


4

SCOM (System Center Operations Manager) or anotehr enterprise tool just is it. Nothing else. 2008 R2 can forward events to another server out of the box, allowing central archiving, but that rules out definitely the 2003 servers.


4

Here's another silly VBScript creation from me, cobbled together from a couple of other scripts. Option Explicit ' Main Dim objShell, objWMIService, objEventSink, dictEventsToMonitor, eventToMonitor ' =====================( Configuration )===================== ' Set to 0 to disable event log reporting of bans / unbans Const USE_EVENTLOG = 1 Const ...


4

You know, there's a cheap little bluetooth device out there that might help you. You plug it in to your USB port and keep the "dongle" in your pocket. When you walk away from your PC (say 6 feet or so) the computer automatically locks. When you come back within range it automatically unlocks. UPDATE: I finally found the one I have. Its a PC Defender ...


4

Have you looked at Microsoft LogParser? Download here With LogParser you can do the filtering you want on the Event log files and export to a type that you want. For Example the following command selects everything from the system event log, where type is not information (EventType 4 is "Information Event") and then outputs that data to csv. LogParser ...



Only top voted, non community-wiki answers of a minimum length are eligible