Network security is no longer an afterthought as it once was for many administrators. An increasing number of administrators are finding themselves involved in various security audits and spending large chunks of their shrinking IT budgets on security auditing tools. Administrators must sift through countless event logs just to answer basic questions about their networks' security.
Auditing event logs is a tedious but important task. Unfortunately, many of us aren't accustomed to saving event logs, so we end up with incomplete data that we must try to use to generate meaningful and accurate reports. The solution, at least going forward, is to automate the process of saving event logs and to create a useful and inexpensive way to generate reports from these logs. In this first article of a two-part series about event-log auditing, I step you through a script that dumps the Security logs for specified servers and saves the output as text files for later processing. In the next article, I'll describe a script to process these log dumps to create an audit of logons and logoffs based on usernames and date ranges.
PsLogList
In "Real-World Scripting: Scripting Tools on the Web," July 2001, http://www.winscriptingsolutions.com, InstantDoc ID 21277, Dick Lewis mentions the PsTools set of utilities from http://www.sysinternals.com, and one of these utilities, PsLogList, caught my eye. PsLogList lets you remotely output to a comma-separated value (CSV) format the event logs of a Windows XP, Windows 2000, or Windows NT machine. This output is ideal for scripting because you can use a simple For loop in an NT shell script to parse the CSV format. The basic syntax for using PsLogList to dump an event log into a file is
PsLogList -s <\\computer_name>
<event_log> <target_file>
For example,
PsLogList -s \\MyPDC
security pdclog.csv
dumps MyPDC's Security log to pdclog.csv. Note that initially, PsLogList might take a long time to run, especially if the log files are large, but if you run the tool daily, the runtime shouldn't be a problem.