Below is an e-mail (slightly altered for privacy) from a colleague that covers cheaply monitoring event logs using freeware tools.
Here is a quick dirty example using a tool called psloglist from
a freeware utility.
This command dumps the security log and clears it:
psloglist -s -c \\serverName security | find /I "," >> c:\junk\filename.log
In the above example the syntax means:
-s list the records one per line with delimited fields, comma being the default delimiter
-c clear the log after dumping it, the account doing this must have those rights
\\<servername> self explanatory
security in this case the security log, other valid entries would be system or application
Then we do a find for the string ignoring case and output the log to a desired location and log name.
The file created is a text file with everything in the log delimited by commas.
Events you might want to track are:
:: Event 539 is Locked-out Account
:: Event 628 is a Password Reset
:: Event 528 is a login (type 2 or 7) local console/tse session
:: Event 540 is a login (type 3) network connection/remote
:: Event 538 is a logoff
:: Event 681 tracks various reasons why a user login was not successful, see below:
:: Error codes Cause
:: 3221225572 User logon with misspelled or bad user account.
:: 3221225578 User logon with misspelled or bad password.
:: 3221225583 User logon outside authorized hours.
:: 3221225584 User logon from unauthorized workstation.
:: 3221225585 User logon with expired password.
:: 3221225586 User logon to account disabled by administrator.
:: 3221225875 User logon with expired account.
:: 3221226020 User logon with "Change Password at Next Logon" flag set.
:: 3221226036 User logon with account locked out.
You can certainly track other events in the Security log and track other logs and their events too. You can parse this text file for example as follows:
find ",681" < c:\junk\name.log
In the above example we do a find for the 681 event using the logfile we created in the log dump as the input.
Now with some creative scripting, a couple of FOR loops using various input files, and the blat utility you could automate this and even have it alert you with an SMTP mail. Schedule it to run using Task Scheduler and there you go, an automated log monitoring. If you wanted to this could also be scripted in VBScript, ADSI and/or also use WMI. The issue there though would be legacy NT4 systems, you might have to install the VBScript, ADSI, and WMI packages on them and perhaps you may not want to or be able to do that. Everything above is free using psloglist, blat, batch scripting, and some time. I like free personally. Thanks.
Mike
