Need NT security evt log analyzer. 1

[Andronium]

I'm looking for an app that can grab security logs from all of our domain controllers, analyze them, and put it into a readable form. It'd be nice to be able to make some graphs showing logins/attempted logins vs. time, or to show logins by username. Is there anything out there that can look at event logs and make customized views of them? Something along the lines of Webtrends for an NT event log is sort of what I'm looking for.

Any suggestions would be appreciated!

Andy

 

[ChrisHirst]

Take a look at Seagate Crystal Reports it can do all that and more you might need to do a bit of programming with the built-in VBA to display graphs and such like but it is no more difficult than something like Excel VBA.

Chris.

 

[Andronium]

That sounds good, but unfortunately I don't know the first thing about VBA. Is it the kind of thing that could be picked up pretty easily?

 

[lifegard2]

Depends on how much $$$ you want to spend. There is a freebie out there called DumpEvt from SomarSoft at

http://www.somarsoft.com.

It comes with a mini-db in Access for extracting Login Failures and raw logs. Be careful though, the DB can get VERY big VERY fast. In about a week, I had about 700MB of data in the db. When I did a compact and repair, I ended up crashing another server (the other server is dependent upon the file server to be able to run a distributed app) because the C&R took exclusive access of the disk and caused other attempted accesses to timeout. SO, it would be a good idea to keep the DB on a local workstation HDD. I have since stopped caring about the other security items, just the failed logins. This has reduced the size of the db considerably.

 

[david902]

I'm using ELM, nice tool, have it setup to monitor for specific events, when they occur, I get an email...

tntsoftware. its $295/server.

well worth the investment.

you can setup custom views the the management console.
very versitle.

 

[lifegard2]

DOH! I forgot about ELM. Star to you David! ELM is, hands down, the best event log monitoring solution I have seen. For a single server, it's not that pricey. The customization, services you can monitor, and the alerts that it offers are excellent

 

[Andronium]

Thanks for the recommendations... I'll give it a look.
Andy