Here's a tip about a little-known but handy auditing tool demonstrated at the recent MCP TechMentor Conference, in San Diego by consultant and speaker Brian Komar.
EventCombMT is a Microsoft auditing tool that allows you to search and pull Event Logs from multiple servers and across multiple domains.
This is not a new tool, so I was surprised at how many attendees didn't raise their hands when Komar asked who had heard of this tool or has used it. If you're leery about getting into the vast and dense world of logs, you should definitely know about this tool and take advantage of how simple it is to use.
EventCombMT allows an administrator to:
- Search for a single Event ID, multiple Event IDs or even a range of Event IDs
- Search for specific event types or sources
- Search for specific text within an event
EventCombMT works for NT4, Windows 2000, XP and .NET. It allows you to search for any logs you wish: system, DNS, security, Active Directory -- you name it. The built-in searches make using it a breeze. Simply check off which log files you want to search and where you want to search -- i.e. all DCs in a domain, a single server, all GCs in a domain, etc. You can specify certain time frames for your searches as well.
This utility collects Event Logs in a text file in comma-delimited format, which allows you to easily import your logs into any database for analysis and historical archiving. Just make sure that you save your log files in a secure folder. There's no point in collecting security logs if you're just going to stick them on a shared drive where any wandering Joe can find them!
One thing to note is that you need to click and highlight whatever you add to your search window before running the search or it won't work. Intuitively you would think that because you've clicked "add" to insert an item into the search box that it would automatically be run against when you initiate the search. But this isn't the case. Hopefully, this heads up will save you some time trying to figure out why your searches are returning bogus results.
Your can download EventCombMT for free as part of Microsoft's Security Operations Guide for Windows 2000 Server. Before getting started with this tool, make sure you check out the EventCombMT information and screen shots in chapter six of the security guide.
