Zen 2.0

Microsoft Windows maintains atleast three event logs:

- Security Log – Tracks events such as logon, logoff, change to access rights, and system startup and shutdown.
- Application Log – Records events logged by applications, such as the failure of MS SQL to access a database.
- System Log – Records events logged by the operating system or its components, such as the failure of a service to start at bootup.

In Windows 2000 or later, there might also be other event logs, including

- Directory Service – Records events logged by Active Directory and its related services.
- DNS Server – Records DNS queries, responses, and other DNS activities.
- File Replication Service – Records file replication activities on the system.

Every Windows event must be identified as one of five event types:

- Information – An informational event that is generally related to a successful action.
- Success Audit – An event related to the successful execution of an action.
- Failure Audit – An event related to the failed execution of an action.
- Warning – A warning. Details for warnings are often useful in preventing future system problems.
- Error – An error, such as the failure of a service to start.

I posted a question to the loganalysis mailing list a while back asking what everyone uses for their collection solution. The summary I gathered is as follows:

1. Snare (or similar agents) sending to syslog…the kewl thing is that Intersect Alliance has provided a couple scripts that will allow you to install Snare onto remote machines in your domain…

2. DumpEvt…this is actually a pretty good way as you can dump logs from local and remote machines and format it the way you want it to…only thing is this is not real-time, so if you are looking for real-time, this is not the solution; however, in my case, I was not looking for real-time.

3. Win32::EventLog…works pretty good, since you can write your own script to do stuff, you can be flexible in what you want to keep or discard…not real-time…but you can easily write something that does what DumpEvt does with the added benefit of dumping the events to syslog…and still be agentless

4. Win32::OLE using WMI…pro’ly the most flexible solution, it can monitor for new log entries…so it can be a real-time solution..plus you have the flexibility of deciding what you want to do with the log once you receive it…send to syslog, discard, etc…however, i have read that this is pretty resource intensive…have not tested this approach to its limit tho…

I will post some sample code for the various collection methods in the future.