W2Kserver security audits

[gsfb]

Since I have set security auditing on our W2K server, the information that accumulates there (viewed by the MS event viewer) is very overwhelming at best. Is there a better way to look at log on events, or does one use a 3rd party software? Thanks--Richard

 

[kev01]

Hi Richard,

- Microsoft got somes pages on how to view and manage event logs in Event Viewer (for Win XP):

http://support.microsoft.com/?kbid=308427

- I also heard about a 3rd party software that can actually better manage event logs but I have never used it. The sofware is called "LANguard S.E.L.M. Event Viewer". Apparantly, the LANguard S.E.L.M. Event Viewer makes things easier. For instance, it categorizes alerts according to how critical they are. "The LANguard event viewer combines all features found in the event viewer in Windows, but adds much more advanced searching, filtering and event managing options." Have a look at their site:

http://www.gfi.com/lanselm/

- Finally, just for ur information..if u have an event ID that u want to know more abt...have a look at

http://www.eventid.net

and perform a search based on the event ID number.


Hope this helps,
Thanks,
Kev

 

[gsfb]

Thanks,helpful ,but I am looking for a way to view security audits using more flexible way than Microsoft has supplied with W2K Server and without spending $400