Monitor Event Logs

Monitor event logs and address security concerns

Managing the volume of event logs generated daily on a system can be quite overwhelming for a user. Considering the same issue in a network with different domains and thousands of systems configured; the scenario gets magnified. Administrators who are responsible for monitoring event logs often find it difficult to search for the particular event log they need from a long list of logged events. But on the other hand, it is also important to monitor event logs and analyze them in order to find the cause of a system related or network related problem.

Event logs can be divided into different categories to understand their significance for maintaining network security:

• Application logs: These logs record events of applications which run on a system, like failure to access a database
• System logs: These logs record OS generated events such job scheduling done by the CPU
• Security logs: These logs contain events that are set for auditing with local group policies
• Directory Service logs: These logs consist of events which occur in the Active Directory or related services
• DNS Server: These logs are used to record DNS queries, DNS responses and other DNS activities
• File Replication Service (FRS) logs: These logs are used to record system based file replication activities
• Other logs: These logs often record events other than those mentioned above, such as about MS Office activities

Windows Event Log Viewer (Eventvwr.msc) helps administrators to monitor event logs of a system and know their status. From the event logs it is possible to know the event log types which are mentioned below:

• Informational: A general information about an event; generally related to a successful event.
• Success Audit: If an event has been executed successfully
• Failure Audit: If an event failed while execution
• Warning: If some problem occurred during an event which can lead to future system errors
• Error: If errors were generated during an event

Detailed messages of all above mentioned event log status can be viewed from the event properties dialog box. For network administrators, it is important to keep a tab on the event logs to identify a problem area. With Windows event log viewer, it is possible to monitor event logs but their management remains an issue. Tools like Lepide Event Log Manager, eases the process by enabling administrators to create a database for compiling event logs of all systems within a network. This helps in recording specific information concerning network or system security and using it for future reference. Furthermore, managing event logs also help in following the regulatory compliances set for organizations.