Windows Event Log Management

Windows Event Log Management

Comprehensive Log Analysis, Archiving, & Reporting For Windows Event Logs

Windows event log management is an important need in almost all enterprises. Logs need to be archived for the purpose of network auditing and more recently to comply with various regulations such as HIPAA Compliance, GLBA Compliance, PCI Compliance, and Sarbanes-Oxley (SOX or SARBOX) Compliance . Apart from this, system administrators look at event logs as a critical source to troubleshoot performance problems on hosts across the network. The need for a complete event log management solution is often underestimated; leading to long hours spent sifting through tons of event logs to troubleshoot a single problem. Efficient event log analysis reduces system downtime, increases network performance, and helps tighten security policies in the enterprise.

EventLog Analyzer can collect, analyze, report, and archive all event logs received from all the Windows systems in your network. EventLog Analyzer also supports logs received from other syslog supported systems & devices.

Some of the many Windows Event Id's recognized by EventLog Analyzer is listed below:

Event ID

Event Type

Description

512, 513, 514, 515, 516, 518, 519, 520 System Events Identifies local system processes such as system startup and shutdown and changes to the system time
517 Audit Logs Cleared Identifies all the audit logs clearing events
528, 540 Successful User Logons Identifies all the user logon events
529, 530, 531, 532, 533, 534, 535, 536, 537, 539 Logon Failures Identifies all the failed user logon events
538 Successful User Logoff's Identifies all the user logoff events
560, 562, 563, 564, 565, 566, 567, 568 Object Access Identifies when a given object (File, Directory, etc.) is accessed, the type of access (e.g. read, write, delete) and whether or not access was successful/failed, and who performed the action
612 Audit Policy Changes Identifies all the changes done in the audit policy
624, 625, 626, 627, 628, 629, 630, 642, 644 User Account Changes Identifies all the changes done on an user account like user account creation,deletion, password change, etc.
(631 to 641) and (643, 645 to 666) User Group Changes Identifies all the changes done on an user group such as adding or removing a global or local group, adding or removing members from a global or local group, etc.
672, 680 Successful User Account Validation Identifies successful user account logon events, which are generated when a domain user account is authenticated on a domain controller
675, 681 Failed User Account Validation Identifies unsuccessful user account logon events, which are generated when a domain user account is authenticated on a domain controller
682, 683 Host Session Status Identifies the session reconnection or disconnection

Using EventLog Analyzer you can archive or store these windows logs, and also generate event log reports in real-time. You get instant access to wide variety of reports for events generated across hosts, users, processes, and host groups. You can also obtain pre-defined compliance reports to meet HIPAA, GLBA, PCI, and Sarbanes-Oxley audit requirements.