Windows Event logs

[ManateeMatt]

I figured this would be the best group to ask as we [H] as a large number of network consultants on it that I'm sure have faced this issue before.

I was wondering what people have done to their event logs for various windows servers (IE auditing, changes, better reporting etc)

I am looking hard at the area around user authentication logging as we have servers on customer sites, and they have had "Unexplainable issues".

 

[ManateeMatt]

Hum, Ill guess Ill have to experiment with this until I find a solution

 

[Dytralis]

I set up a syslog server based on Syslog-NG and use eventlog-to-syslog (http://code.google.com/p/eventlog-to-syslog/) to send the data to the syslog server from the windows servers. it works pretty well.

we also use pre-version 3.0 php-syslog-ng (http://code.google.com/p/php-syslog-ng/) as a front end. it works very well for searching and filtering the events