Re: Security log file size (Windows 2003)

From: karl levinson, mvp (levinson_k_at_despammed.com)
Date: 11/27/05

  • Next message: Roger Abell [MVP]: "Re: How to Stop a Service From Impersonating Other Users" 
    Date: Sun, 27 Nov 2005 07:41:04 -0500

    In addition to the other answers, I would note that event log files can be
    exported / archived to another computer for posterity and can grow as large
    as you want there.

    One way to do this is via syslog. There are a number of free windows event
    log to syslog solutions, such as ntsyslog. Kiwi has some syslog solutions.
    You might consider Snare, which is still free and adds encryption and
    support for collecting logs from linux, routers, firewalls, etc.

    http://www.intersectalliance.com/projects/SnareWindows/

    Another way to do this might be via a script that dumps the logs using the
    log dump utilities psloglist from www.sysinternals.com [free] or dumpel from
    Microsoft. With these tools, you may need to script a way to import them
    back into a database.

    http://www.sysinternals.com/Utilities/PsLogList.html
    http://www.microsoft.com/windows2000/techinfo/reskit/tools/existing/dumpel-o.asp

    "Eugene Hovjacky" <ehovjack@bigpond.net.au> wrote in message
    news:uPzYrqg8FHA.3592@TK2MSFTNGP12.phx.gbl...
    > Hi,
    >
    > What is the largest Event log size the Windows 2003 server can
    > accommodate? I plan to raise the level of logging on our domain
    > controllers and of course I need to increase the Event log sizes,
    > currently I have them set to 64meg. I have plenty of disk space. What the
    > largest anyone has created?
    >
    > Thanks.
    >

  • Next message: Roger Abell [MVP]: "Re: How to Stop a Service From Impersonating Other Users"

    Relevant Pages

    • Re: change event log location to remote drive?
      ... somehow inspect or copy the event log entries via a remote system. ... There are a number of free windows event log to ... Kiwi has some syslog solutions. ...
      (microsoft.public.win2000.security)
    • Windows 2003 VB Script Follow-Up Question
      ... I slipped in Security to the privilege ... I understand that the first line of the script ... >> clear their Security Event Log. ...
      (microsoft.public.scripting.vbscript)
    • Re: Logon Script
      ... The script writes to a share that only administrators have access to ... The domain controller event log is ... the logon type would be a bear. ... I know how to verify in the event log based ...
      (microsoft.public.scripting.vbscript)
    • Re: Script just stops running even though on error resume next
      ... It writes properly to the event log before the ... bind, but never gets to write to the event log after the bind. ... You recommended using the LDAP provider - I will update my script and post ... I have an example VBScript logon script that uses ADSystemInfo and maps ...
      (microsoft.public.scripting.vbscript)
    • Re: Flexibility of Eventriggers in Win2003 - query on source + wil
      ... I created a very broad event trigger that looks only at entries of /EID "3" ... The event trigger runs a batch file that then calls a vbs script that uses ... WMI to interogate the event log directly pulling out the last few entries. ... Namely to tweak it so that it will check to see if it has sent the admin ...
      (microsoft.public.windows.server.general)