RE: Event log managment

From: H C (keydet89@yahoo.com)
Date: 12/13/01 

Date: Thu, 13 Dec 2001 12:51:19 -0800 (PST)
From: H C <keydet89@yahoo.com>
To: "McLeod, Dennis" <Dennis.McLeod@Nolte.com>, "'focus-ms@securityfocus.com'" <focus-ms@securityfocus.com>

> We use dumpel (Resource Kit) to dump them to text
> files.
> We then use BCP to dump the text files into a sql
> database.
> One of our programmers wrote some code to clear the
> event logs.
> I then use Excel to check my event logs.

Want to do all of this in one program? Perl, baby!
Yeah, that's right! Grab the EL entries, dump them to
a SQL db as well as to comma-delim. text files (or, if
you want to correlate activity across the domain, use
three worksheets, one for each of the main EventLogs).
 Oh, yeah, and it'll clear the logs, too. Of course,
you could add to that a verification that you're
EventLog settings (size, what's being audited, etc)
hasn't been altered...

> I plan on making a schduled task run every half
> hour, and then my database
> guru will
> write a stored procedure looking for events I
> specify.

You know what may work for you is to install a syslog
client on the various systems, and have them forward
the log entries to a syslog server. just a thought...

__________________________________________________
Do You Yahoo!?
Check out Yahoo! Shopping and Yahoo! Auctions for all of
your unique holiday gifts! Buy at http://shopping.yahoo.com
or bid at http://auctions.yahoo.com

Relevant Pages

  • Re: cidump documentation?
    ... Here is how I dump the catalog I created in C:\Program Files\Microsoft SQL ... Select what to dump: ... Select the keys to dump: ...
    (microsoft.public.sqlserver.fulltext)
  • Re: HELP: SQL in Excel VBA
    ... I had a macro that went through each column and counted how many rows were ... I previously used the pre-2007 code to dump data which worked great but now ... with the 2007 version of the code, it appears the data is treated as a pivot ... I had to change the code for doing the sql because the old code didn't like ...
    (microsoft.public.excel.programming)
  • OS Panic D800
    ... FLT 020B. ... > We tried doing a memory dump and the system faulted. ... >Do You Yahoo!? ... Mail has the best spam protection around ...
    (comp.sys.hp.mpe)
  • Re: Convert table data to a linked table
    ... Dump the tables to SQL, link them back in, rename dbo_tblEmployees to ... "Mike Brown" wrote in message ... > forms, reports, etc that use those tables. ...
    (microsoft.public.access.tablesdbdesign)
  • Re: Help with error 3624.
    ... Looks like you are using the SQL 7 with SP3. ... the SP4 for SQL 7 and try doing the same query gain and check if the ... > The dump is somethin like this. ... > Stack Dump being sent to d:\MSSQL7 ...
    (microsoft.public.sqlserver.server)