Windows NT Event Logging

Description

Event logging is a facility used by computer systems to record the occurrence of significant events. An "event" is any change that occurs in a system -- for example, a user logon, an addition to a file, or a change to a user's privileges. Because a computer system may experience hundreds or thousands of events each second, it is important to distinguish which events require the immediate attention of a system administrator, which should be recorded as entries in the system's event log for later analysis, and which can be safely ignored.

Event logs provide a centralized collection point for all kinds of error reports, system alerts, diagnostic messages, and status messages generated by a system. This book describes the characteristics of these messages, why they are important, and how you can access them and act upon them. Event logs are particularly important to system security and problem troubleshooting. Windows NT systems generate three distinct types of event logs:

• Security log. Stores reports of security-related events -- for example, a user has written to a file or there has been a change in a user's privileges.
• System log. Stores reports generated by system components, including drivers and services -- for example, a device failed, a driver failed to load, or a memory allocation or I/O error occurred.
• Application log. Stores reports on all other events -- for example, an internal application error (such as a failure to allocate memory) occurred, or a file download aborted.

This book is aimed at several specific audiences:

For system administrators, event logging is a tool for analyzing system and user activities and performance and for troubleshooting system problems. For this audience, the book explains how to view and maintain the event logs via the system's Event Viewer and how to interpret the results.

For programmers, event logging helps in diagnosing system or network problems. For this audience, the book describes the event logging API (Application Programming Interface) and the internals of the system's message files. It also provides instructions for and examples of accessing (reading, backing up, clearing, monitoring, and writing to) the event logs from C, Visual Basic 5, Perl 5 for Win32, Visual J++, and a C++ class for MFC (Microsoft Foundation Classes).

For security administrators, event logging is an important tool in auditing security-related events and tracking down the source of security breaches. For this audience, the book provides help in specifying the events to be audited and in analyzing auditing results; it also discusses the security auditing requirements imposed on a C2-level secure system (one approved by the U.S. government's National Computer Security Center).

The book comes with a CD-ROM containing examples from the book and many contributed event logging and auditing software packages. A brief table of contents follows:

Preface 1. About Event Logging 2. The Event Logging Service 3. Even Viewer
4. Windows NT Security Auditing
5. The Event Logging API 6. Message Files 7. Accessing the Event Logs 8. Reporting Events

A. References and Resources B. Event Logging under Windows for Workgroups C. NT Security Auditing Events
D. DumpEl: Event Logging Dump Utility E. Kernel-mode Event Logging F. What's on the CD-ROM?

Get the book

Amazon.com

Search the book

eBay.com

Search the book

Similar books

• 

  MCSE Supporting and Maintaining a Windows NT Server 4.0 Network: Training Guide

  By Dennis Maione, Roberta Bragg, Jim Cooper

  The leading certification product covering one of the hottest MCSE 2000 electives. This book not only prepares the reader for the exam, it provides them with the real-world ability to...

• 

  System Center Operations Manager 2007 Unleashed

  By Cameron Fuller, Kerrie Meyler, John Joyner

  The management packs are stored in the Operational database, which you should back up as part of your standard procedure. ... If you are running IIS 6.0 with Windows Server 2003, the IIS metabase is automatically backed up each time the ...

• 

  Intrusion Detection

  By Rebecca Gurley Bace

  Sir Arthur Conan Doyle Given a variety of rich information sources about the system activities you're charged with monitoring , the next stop on the intrusion detection circuit is analysis . With analysis , you're faced with the core ...

• 

  Windows Server Cookbook: For Windows Server 2003 & Windows 2000

  By Robbie Allen

  This practical reference guide offers hundreds of useful tasks for managing Windows 2000 and Windows Server 2003, Microsoft's latest and greatest server.

• 

  COM Beyond Microsoft: Designing and Implementing COM Servers on Compaq Platforms

  By Terence Sherlock, Gene Cronin

  As implemented on Tru64 UNIX , you can also use the COM df2t utility to assign an STGM enumeration value to the ... Under the COM standard , TRANSACTED mode buffers any storage element changes until the client issues an explicit commit ...

• 

  Introduction to Microsoft Windows NT Cluster Server: Programming and Administration

  By Raj Rajagopal

  LIFEKEEPER FOR WINDOWS NT LifeKeeper from NCR is a clustering solution that runs on NCR servers . LifeKeeper features multiple fault detection mechanisms , real - time repair , cluster administration from a single console in the cluster ...

• 

  Microsoft SQL Server 2000 DBA Survival Guide

  By Mark Spenik, Orryn Sledge

  Organized into several parts that comprise the various jobs and tasks the DBA performs, each chapter of this book is presented with the goal of providing knowledge and "know-how" to Database Administrators of a SQL Server database.

• 

  Learning DCOM

  By Thuan Thai

  ... event log. • Log message—You'll finally learn how to log messages to the event log. We will develop a simple C++ class that supports message logging to the Windows NT event log; we'll call this class CEventLog. The constructor will get an ...

• 

  SMS 2 Administration

  By Mike Lubanski, Darshan Doshi

  Darshan Doshi is an SMS architect at Merrill Lynch . He is also the president of CJ Technologies USA , Inc. , a consulting firm focusing on Microsoft Windows NT and Microsoft BackOffice technologies . He is a Microsoft Certified Systems ...

• 

  Performance Evaluation: Origins and Directions

  By Günter Haring, Christoph Lindemann, Martin Reiser

  To understand and master the complexity of these systems, a plethora of performance analysis tools and techniques have ... In Proceedings of the Workshop on Debugging and Performance Tuning for Parallel Computing Systems, M. L. Simmons, ...