If you aren't familiar with Windows NT's event logs, take a quick
look at NT's built-in Event Log viewer. You can run Event Viewer on NT 4.0 from
the Start menu by selecting the Program option and then the Administrative Tools
(Common) option. The Event Viewer option on the Administrative Tools submenu
starts NT's Event Viewer. Screen A shows a sample system Event Log through Event
Viewer.
Event Viewer lets you view the NT Event Log for either a local or remote NT
system. In Screen A, you can see each event. A color signals its priority:
Yellow is for a warning event, blue signals an informational event, and red
signifies a warning event. Event Viewer also shows the date and time the event
was generated and the event ID, the user, and the computer on which the event
was generated.
The three types of NT event logs are:
* System log, which tracks miscellaneous system events (for
instance, the system log tracks events during system startup and hardware and
controller failures)
* Application log, which tracks application-related events (for
instance, some applications generate informational messages that appear as
entries in the Application Event Log; application errors such as failing to load
a DLL can also appear in the application log)
* Security log, which tracks events such as logon, logoff, changes
to access rights, and system startup and shutdown. However, by default, the
security log is turned off. To track security events with Network Security
Monitor, you must start NT event logging on the target remote systems. To enable
NT security logging, you must sign on with a user ID that has administration
rights. Then from the Start Menu, choose Program and then Administrative Tools
(Common). From the Administrative Tools submenu, choose User Manager, which
displays the User Manager window. Select Audit from User Manager's Policies menu
to display the audit dialog