Windows Logging.ppt

The Event Collector Wizard Other Alternatives Other features in the new-look logs include the ability to attach a task to a particular log (a wizard runs). The scheduled job can then be tidied up and/or developed in the usual way using the Scheduler. There is also the ability to create Custom Logs for particular tasks. Some particularly useful pre-supplied logs are included with the various new role functions in Windows Server 2008. For example if a Windows 2008 server is set up as a Windows Terminal Server Gateway (TSG) then a log of who is accessing the TSG is automatically started. Attaching a Task to a log… Mixed Solutions It is perfectly possible to use a combination of Log Parser and the new functionality of normal Vista logging to handle more complex tasks. For example you could use the new Forwarded Events log to collect all event of any severity from domain computers and then run the resulting output through Log Parser (which also produces CSV and TSV output) into the database of your choice… For the brave here’s the Microsoft take on AD auditing: /en-us/library/cc731607.aspx The Future Well what can I say? If you are interested you can read the Microsoft Center Team’s plan to take over the world: /systemcenter/archive/2008/04/29/operations-manager-2007-goes-cross-platform.aspx THE END Windows Logging Or managing the morass... The Good Old Days... Back in the good old days of Windows NT, there were three main logs: The Application log The System log The Security log, which you almost never saw enabled on desktops. Windows 9x (95/ 98 and ME) of course didnt bother with anything so sophisticated. Most users never realised that Windows logs existed. Even those who did had no idea what most of the error messages meant. Then life got a lot more complicated... Currently there are two main setups, pre-Vista and post-Vista. The logs which most sysadmins are used to are probably still the main three logs of Windows NT although the some minor tweaks ha