Chapter 3 - Exploring the Windows Event Log

Abstract

The critical aspects of ensuring a system's stability are the ongoing monitoring and analysis of System event logs. Like UNIX systems, Microsoft Windows operating systems (OSs) have logging features that can aid in diagnosing system problems and ensuring that the system is optimized and secured. Most administrators do not make full use of these features because of the extensive amount of time it takes to read through thousands of log file entries. This makes it difficult for administrators to take a proactive approach to systems administration by eliminating problems before they become critical. This chapter discusses the way in which Log Parser can help with this task, making a tedious task not only easy but fun as well. The chapter discusses many of the features available in Log Parser for working with Windows event logs. There are a few key points to remember when working with these logs: (1) differentiating between single and multiple events is a critical feature in Log Parser for working with the Security event log; (2) differentiating between benign events and actual errors or warnings is very important for having an accurate view of your system environment; and (3) when working with applications and the Application event logs, it is important to have a thorough understanding of the specific application.