Event Id's

[brian80909]

Does anyone know where I can find a comprehensive list of the most common event ids for all three system logs (system,security.application)? I am writing a script that would parse the logs and alert on specific id's. I have a pretty good list of NT and Kerb events in the security log. But I have had no luck finding anything on the system and app logs.

 

[kmcferrin]

http://www.eventid.net

They have a subscription service, but there is a great deal of info available for free on their site as well (I've never bough the sub and I use it all the time).

 

[brian80909]

kmcferrin, Thanks for the quick reply!
I have used eventid.net in the past but I have not been able to find just a list of event id's. All I can find on that site is a form to search their database for specific id's. I need to be able to list ID's for my script to alert on. I know the ones I see in my log all the time, but I would like the script to be as comprehensive as possible.

 

[Davetoo]

Just in case you're trying to reinvent the wheel, you might want to check out GFI's Languard SELM.

I'm Certifiable, not certified.
It just means my answers are from experience, not a book.

 

[brian80909]

Yeah I guess I am trying to re-invent the wheel. Problem is I have absolutly no budget for Languard or similar products. So I thought if I could write (or steal) a perl script that does about the same thing I'd be much further ahead. I found a script that is already set up for the security log, I just wanted to add the same functionality for the app and system logs.

 

[Davetoo]

The GFI product is free to use for one server.

I'm Certifiable, not certified.
It just means my answers are from experience, not a book.