Event Log Monitoring
What are Windows Event Logs?
The event logs contain the most important information for diagnosing application and operating system failures, determining the health and status of a system and verifying that system and applications are operating properly.
Windows systems store all logs in binary .Evt files and there are three basic event logs: Application (AppEvent.Evt), System (SysEvent.Evt), and Security (SecEvent.Evt). Windows 2000 (and later) servers may contain additional event logs: DNS Server (DNSEvent.Evt), File Replication Service (NtFrs.Evt), and on Active Directory domain controllers, Directory Service (NTDS.Evt).
System log tracks miscellaneous system events like startup, shutdown and events like hardware and controller failures. The Application log is an important source for application status information. When properly integrated with the Windows operating system, applications can report their errors to the Event log by recording an event entry into the Application log. Security log tracks events such as logon, logoff, changes to access rights, and system startup and shutdown.
OpManager On-Demand's Event Log Monitoring
OpManager On-Demand's eventlog monitoring collects data from all devices that use Windows event logs and uses several automated rules to monitor critical logs across all windows servers and workstations in a network and automatically generates alerts over real time.
You can easily detect events such as failed logons, logon failures due to bad passwords, account lockouts, failed attempts to access secure files, security log tampering etc. Also, rules can be set to monitor applications, security, DNS servers, file replication and directory services.
Benefits
- Securing your network from internal attacks
- Monitoring availability of your critical applications
- Centralized eventlog management integrated with your network monitoring software
|