Setting up an ALERT when the security log reaches a certian size.

Thread View: comp.os.ms-windows.nt.admin.networking

2 messages

[T] Back to Threads [V] Tree View [G] Group Articles

2 total messages Started by Simon Wed, 07 Feb 2001 11:23

#65

Author: Simon
Date: Wed, 07 Feb 2001 11:23

24 lines
2864 bytes

HI guys, I would love your help on this one please.
A folder needs to be audited for Read and Write events. A lot of files will
be written to this folder.
Ive set up auditing in UM4D  (File and Object Access), and specified Success
and Failure on these etc.
Then I set up the auditing on the folder itself, and added the appropriate
users and auditing levels per user/group.
Due to the number of files that will be written, and possibly read, the
default size of the security log of 512K is not large enough, so I monitored
its growth for 2hours, and calculated that Id have to save the security log
to file every 2 days, if I set its ceiling to 20MB. I set the log to
manually clear events, and not to overwrite, as they want all events logged!
The security log I know is saved as secevt.EVT in c:\winnt\system32\config
folder.

What I want to be able to do is instead of having to constantly monitor the
size of the security log, and then manually save it to file, then clear out
the log and start again, is to be ALERTED over the network, maybe through a
net send message, that the file has reached a certain peak eg.15MB, so that
I can then take the appropriate action of saving the log and clearing it out
for future events. Ive looked in Performance Monitor, but I cant seem to
find any objects that will be able to do this.

Thank you

Re: Setting up an ALERT when the security log reaches a certian size.

#66

Author: H C
Date: Wed, 07 Feb 2001 11:48

18 lines
2085 bytes

Simon,

Why not automate the whole thing? Why not have a Perl script set up on another
machine,
that will automatically retrieve and clear the EventLog for you?  You can use a
variety of tools
to pull the EventLog into a spreadsheet or a database for processing, filter the
EventLog entries,
clear the EventLog, etc.

For some examples of this, check out http://www.forixnt.com/tools.html

> What I want to be able to do is instead of having to constantly monitor the
> size of the security log, and then manually save it to file, then clear out
> the log and start again, is to be ALERTED over the network, maybe through a
> net send message, that the file has reached a certain peak eg.15MB, so that
> I can then take the appropriate action of saving the log and clearing it out
> for future events.

Thread Navigation

This is a paginated view of messages in the thread with full content displayed inline.

Messages are displayed in chronological order, with the original post highlighted in green.

Use pagination controls to navigate through all messages in large threads.

Back to All Threads