this post was submitted on
13 points (100% like it)
13 up votes 0 down votes
shortlink:
to anything interesting: news article, blog entry, video, picture...

12
13

Way to centralize Windows event log viewing? (self.sysadmin)

submitted ago by spiralsmurfWindows Admin

Is there a way to centralize the Windows event log viewing onto a single server? I'm not referring to opening event viewer and connecting to different servers, but actually having them ship logs to a central machine much like syslog.

all 13 comments
sorted by:
best
hot
new
controversial
top
old

[–]Blahbl4hblah 6 points7 points ago

windows server 2k8+ can centralize eventlogs with "event forwarding"

[–]Fart_and_Dart 0 points1 point ago

Indeedy. I do this! :) Need 2k8 mind as the collector I think. I didnt know until just now, but I think XP clients and Windows 2k3 Servers can be subscribed to.

http://msdn.microsoft.com/en-us/library/windows/desktop/bb427443(v=vs.85).aspx

[–]spiralsmurfWindows Admin[S] 0 points1 point ago

Yes, there is an update for xp/03 that will let them forward. I just set this up for a small client, but I am going to try Splunk for a larger client with 25+ servers.

[–]darksim905Hot Spare Windows Sysadmin 0 points1 point ago

When you forward the events, do the events stay on that machine, or get pushed/parsed to the server? Can you delete the events after a certain amount of time/after viewing? That would be pimp.

[–]5y5tem5 1 point2 points ago

these maybe of interest.

http://blogs.technet.com/b/wincat/archive/2008/08/11/quick-and-dirty-large-scale-eventing-for-windows.aspx

http://www.avecto.com/documents/solution-guides/EventCentralization.pdf

[–][deleted] ago

[deleted]

[–]da7rutrak 2 points3 points ago

Much, much love for Splunk.

[–]darksim905Hot Spare Windows Sysadmin 0 points1 point ago

Oh Splunk, free shirts if you just ask at conventions. Because ninjas are too busy :)

[–]JerkyChew 1 point2 points ago

You don't need an agent, you can get all the event logs via remote WMI, although I believe if you go that route Splunk needs to run as a domain admin.

[–]kordless 4 points5 points ago

Use Snare (http://www.intersectalliance.com/projects/BackLogNT/) to ship them off to a centralized syslog server you set up or a service like Loggly. Solarwinds also writes a syslog server for Windows, which could be used instead of a Linux based syslog destination.

[–]CanDivideByZeroshutdowning -1 points0 points ago

GFI events Manager. It's not free though.

http://www.gfi.com/eventsmanager

[–]AlmostPerson 0 points1 point ago

EventSentry works nice and has a Web interface to view. Can also send email alerts for specific events.

[–]whateverradar 0 points1 point ago

kiwi sys log server. http://www.kiwisyslog.com/kiwi-syslog-server-overview/

I love it.

[–]spiralsmurfWindows Admin[S] -1 points0 points ago

nvm, found this http://windowsecurity.com/articles/Centralized-Auditing-here-FREE.html

Unless you guys have a better suggestion.

Use of this site constitutes acceptance of our User Agreement and Privacy Policy. © 2012 reddit inc. All rights reserved.

REDDIT and the ALIEN Logo are registered trademarks of reddit inc.

π Rendered by PID 5290 on app-65 running c21fb21.