Here's a tip about a little-known but handy auditing tool demonstrated at the recent MCP TechMentor Conference, in San Diego by consultant and speaker Brian Komar.
EventCombMT is a Microsoft auditing tool that allows
This is not a new tool, so I was surprised at how many attendees didn't raise their hands when Komar asked who had heard of this tool or has used it. If you're leery about getting into the vast and dense world of logs, you should definitely know about this tool and take advantage of how simple it is to use.
EventCombMT allows an administrator to:
- Search for a single Event ID, multiple Event IDs or even a range of Event IDs
- Search for specific event types or sources
- Search for specific text within an event
EventCombMT works for NT4, Windows 2000, XP and .NET. It allows you to search for any logs you wish: system, DNS, security, Active Directory -- you name it. The built-in searches make using it a breeze. Simply check off which log files you want to search and where you want to search -- i.e. all DCs in a domain, a single server, all GCs in a domain, etc. You can specify certain time frames for your searches as well.
This utility collects Event Logs in a text file in comma-delimited format, which allows you to easily import your logs into any database for analysis and historical archiving. Just make sure that you save your log files in a secure folder. There's no point in collecting security logs if you're just going to stick them on a shared drive where any wandering Joe can find them!
One thing to note is that you need to click and highlight whatever you add to your search window before running the search or it won't work. Intuitively you would think that because you've clicked "add" to insert an item into the search box that it would automatically be run against when you initiate the search. But this isn't the case. Hopefully, this heads up will save you some time trying to figure out why your searches are returning bogus results.
Your can download
EventCombMT for free as part of Microsoft's
Security Operations Guide for Windows 2000 Server. Before getting started with this tool, make
sure you check out the EventCombMT information and screen shots in chapter
six of the security guide.
This was first published in September 2002