Event-Log Auditing, Part 1

Automate event log dumps

Info-ZIP
If you run PsLogList daily, the text files that PsLogList creates will grow large over time, and you'll want to group and compress the log files into fewer and smaller .zip archives. Every scriptwriter needs to have at least one command-line utility to compress and uncompress .zip files. In the script I created for this article, I use Info-ZIP. I chose Info-ZIP over the many commercial compression utilities available because it's an easy-to-use freeware tool. If you want to use Info-ZIP, I suggest you download both the Zip (http://www.info-zip.org/zip.html#win32) and UnZip (http://www.info-zip.org/unzip.html#win32) utilities. If you already have a command-line compression tool or you prefer to use a commercial utility, you can easily substitute a different tool for Info-ZIP in the script, provided that it has command-line parameters to move files into a .zip archive.

LogDump.cmd
Your first task in the ultimate goal of creating a logon/logoff auditing report is to create daily dumps of the Security logs of all your domain controllers (DCs). I created a sample script, LogDump.cmd, which Listing 1 shows, that automates this task. Although the script will run in any Win2K or NT environment, for simplicity, the script assumes that you administer a small NT network with one PDC and one BDC. . . .

This script has been incredibly useful, but I've recently encountered problems with it on AD domain controllers running Windows 2003, where the script scheduled to run every 24 hours. This isn't a problem with the script itself but I thought other readers might be interested.

Very frequently, under this configuration, the process hangs and the resulting .csv doesn't ever close (or at least, doesn't close before the next scheduled collection starts). The results have been logs over 20 G in size and filled-up hard drives. A look at the Task Manager shows multiple PSLOGLIST processes running, one for each day the script was to have executed. I believe this is a result of the traffic being processed by the domain controllers - they're each logging about a million entries every 24 hours. The script is excellent on Windows 2000 (even domain controllers) and on Windows 2003 member servers. Just beware that a very busy security event log on a domain controller can cause this to hang.

(A good solution here might be to get a few more domain controllers!)

Thanks for an excellent forum.

Prestage October 12, 2004 (Article Rating:

)

You must log on before posting a comment.

If you don't have a username & password, please register now.