Windows & .NET Magazine UPDATE, brought to you by Windows & .NET Magazine, the leading publication for IT professionals deploying Windows and related technologies.
http://www.winnetmag.com
Mark Minasi, senior contributing editor for Windows & .NET Magazine, provides insights into and analysis of today's hot Windows 2000 and .NET trends.
THIS ISSUE SPONSORED BY
Real Time Monitoring Saves Time and Money
http://www.tntsoftware.com/download/
Ultimus Workflow Suite Enterprise BPM Platform
http://www.ultimus.com/optin/winnet10.htm
(below COMMENTARY)
SPONSOR: REAL TIME MONITORING SAVES TIME AND MONEY
A proactive IT Manager installed TNT Software's ELM Enterprise Manager 3.0 on his critical servers to assess the benefits of real time monitoring. During the first week, EEM 3.0 paged him as a disgruntled employee attempted to access confidential files, alerted him when his Exchange Server slowed down, and automatically restarted a failed SQL service. And one less headache, EEM 3.0 was simple to license. ELM Enterprise Manager was purchased and fully deployed in the second week. Real Time Monitoring with ELM Enterprise Manager saves time and money. To download your FREE 30-day evaluation copy visit:
http://www.tntsoftware.com/download/
October 25, 2002—In this special issue, Mark Minasi discusses a free tool that will help you make sense of your event logs.
Maintaining event logs is like flossing—we know we're supposed to do it, but...
Over the past few years, network security has moved from a "we oughta" task for a lot of firms to a "we gotta" task. But network security isn't painless: Firewalls aren't cheap, tighter password rules create unhappiness among employees, and writing security procedures is tedious.
Microsoft equipped Windows NT with a rich set of security-logging tools that you can use to audit every event on every machine on your network. In no time, you'll have a wealth of information about who's doing what—and where and when they're doing it.
But how do you use this information to secure your network? For example, you might think that you can just peek at the Security event logs to see whether someone's trying to hack your system, right? Well, not exactly.
Windows .NET Server (Win.NET Server) 2003, Windows XP, and Windows 2000 store auditing information in each system's Security event log. Thus, if you have 20 servers and 1000 workstations, you'd have to look through 1020 Security event logs, each on a separate computer. So trying to figure out something relatively simple becomes a major task that requires visiting lots of computers and searching for a particular event ID.
With the Security event logs, Microsoft developers gave us a great security auditing and warning tool but neglected to add a centralized way to manage, store, and query the logs. (Well, they didn't leave it out; they decided to charge separately for it in the form of Microsoft Operations Manager—MOM.) I can't solve the "manage and store" part today, but I've discovered a nifty tool for looking through piles of Security event logs—a free Microsoft application called EventComb.
EventComb is part of a Microsoft document called "Security Operations Guide for Windows 2000 Server." To obtain EventComb, you need to go to http://www.microsoft.com/downloads/release.asp?releaseid=36834 and download secops.exe. When you run secops.exe, the program creates a folder called SecurityOps. Within SecurityOps is a folder named EventComb, which contains a compiled HTML Help file and the EventComb program.
To illustrate how EventComb works, let's perform a simple event log search. Because you currently might not have anything in your Security event log, let's search the System event log for something we'll likely find: We'll look for messages from W32Time, the service that synchronizes your system time to some outside time source.
When you open EventComb, you'll see why the application is free: The user interface definitely leaves something to be desired. The left-hand side of the application window contains a box labeled "Select to Search/Right Click to Add." Right-click inside the box and in the field that opens, enter the name of the computer you want to search. Add as many computers as you want, but the more machines you search, the longer the search will take.
In the EventComb window, you'll see a series of check boxes under the heading "Choose Log Files to search." Select System. Under "Event Types," select the check boxes next to Error, Informational, and Warning. In the lower-left of the EventComb window, you'll see a text field labeled "Event IDs"; leave the field blank. Below that field is a drop-down list called "Source"; select "W32Time." Click Search and wait for the application to finish searching.
When EventComb finishes searching the specified computer, the program opens a window showing the C:\Temp directory, in which it keeps the search results and log files. You'll see a text file named <systemname>-System_LOG.txt. For example, if you search a machine named MYPC, you'll get a file named c:\temp\MYPC-System_LOG.txt. Open the file with Notepad to see a list of W32Time-related events.
EventComb lets you create far more complex searches than the example I used, and also lets you create and store searches for future use. (Here's an interesting search: Check the System log for errors on source "atapi." You might be surprised by the number of hard disks on your network that are a little wobbly.)
So download a copy of EventComb and start making use of your event logs! (And keep flossing; it's good for the gums.)
Mark Minasi, Senior Contributing Editor, Windows & .NET Magazine, [email protected]
SPONSOR: ULTIMUS WORKFLOW SUITE ENTERPRISE BPM PLATFORM
The Ultimus Workflow Suite is an essential component of the enterprise nervous system that orchestrates your mission-critical business processes. Leverage seamless integration with third-party applications using Ultimus Flobots (workflow robots) that reduce cost, eliminate manual intervention and increase customer response. Learn first-hand how real-time enterprise-level workflow automation and business process management can improve efficiency in your company. Sign up for an Ultimus Webinar and a FREE whitepaper, "Categorizing and Evaluating Workflow Automation Software."
http://www.ultimus.com/optin/winnet10.htm
ANNOUNCEMENT
(brought to you by Windows & .NET Magazine and its partners)
If you haven't seen Connected Home Online lately, you're missing the definitive resource to help you tackle home automation, install a home network, set up a home theater, and much more. Visit today, and while you're there, check out this article about installing a 100Mbps home network at http://www.connectedhomemag.com/networking/articles/index.cfm?articleid=24765
Check it out!
http://www.connectedhomemag.com
HOT RELEASE (ADVERTISEMENT)
Learn Windows 2000/XP management from expert author/speaker Mark Minasi's books, audio seminars, and live classes. "Take George Carlin, make him techie, and clean up the language...you've got Minasi," a recent attendee says.
http://list.winnetmag.com/cgi-bin3/flo?y=eNKM0CFYDW0CBo0qZn0At
CONTACT US
Here's how to reach us with your comments and questions:
- ABOUT THE COMMENTARY — [email protected]
- ABOUT THE NEWSLETTER IN GENERAL — [email protected];
please mention the newsletter name in the subject line. - TECHNICAL QUESTIONS — http://www.winnetmag.com/forums
- QUESTIONS ABOUT YOUR WINDOWS & .NET MAGAZINE UPDATE SUBSCRIPTION? Customer Support — [email protected]
- WANT TO SPONSOR WINDOWS & .NET MAGAZINE UPDATE?
[email protected]
