Windows Event Log Monitoring and Management

Comprehensive Windows Event Log Monitoring, Analysis, Reporting and Archiving Software

Windows Event Log management is an important need in almost all enterprises. EventLog Analyzer can collect, analyze, report, and archive all event logs received from all the Windows systems in your network. Windows Event Log Monitor and Analysis are the important functions performed for Windows Event Log Management. As part of Windows Event Log monitoring, EventLog Analyzer collects, normalizes, aggregates Windows Event Logs. Windows Event Log Analyzer application analyzes the logs, generate pre-built reports, regulatory compliance reports, historical trend reports, andgenerate alerts for specific Windows log events. Windows Event Logs need to be archived for the purpose of network auditing and more recently to comply with various regulatory acts such as HIPAA Compliance, GLBA Compliance, PCI-DSS Compliance, and Sarbanes-Oxley (SOX or SARBOX) Compliance. Apart from this, system administrators look at event logs as a critical source to troubleshoot performance problems on hosts across the network. The need for a complete event log management solution is often underestimated; leading to long hours spent sifting through tons of event logs to troubleshoot a single problem. Efficient event log analysis reduces system downtime, increases network performance, and helps tighten security policies in the enterprise.

EventLog Analyzer also supports logs received from other syslog supported systems & devices.

Windows Event Log monitoring is a prime function of EventLog Analyzer. The Windows event log monitoring software supports the Windows logs of all versions, Windows 2003 server event logs, Windows 2008 server event logs, Windows NT event logs, Windows 2000 event logs, Windows XP event logs, and Windows Vista event logs. The event log manager software can also analyze the Windows Vista and 2008 event logs, which is in extended EVT format (type .evtx format supported in Windows Vista and 2008 machines only).

Some of the many Windows Event IDs and Windows Vista Event IDs recognized by EventLog Analyzer are listed below:

Windows Event ID	Windows Vista Event ID	Event Type	Description
512, 513, 514, 515, 516, 518, 519, 520	4608, 4609, 4610, 4611, 4612, 4614, 4615, 4616	System Events	Identifies local system processes such as system startup and shutdown and changes to the system time
517	4612	Audit Logs Cleared	Identifies all the audit logs clearing events
528, 540	4624	Successful User Logons	Identifies all the user logon events
529, 530, 531, 532, 533, 534, 535, 536, 537, 539	4625	Logon Failures	Identifies all the failed user logon events
538	4634	Successful User Logoffs	Identifies all the user logoff events
560, 562, 563, 564, 565, 566, 567, 568	4656, 4658, 4659, 4660, 4661, 4662, 4663, 4664	Object Access	Identifies when a given object (File, Directory, etc.) is accessed, the type of access (e.g. read, write, delete) and whether or not access was successful/failed, and who performed the action
612	4719	Audit Policy Changes	Identifies all the changes done in the audit policy
624, 625, 626, 627, 628, 629, 630, 642, 644	4720, 4722, 4723, 4724, 4725, 4726, 4738, 4740	User Account Changes	Identifies all the changes done on an user account like user account creation,deletion, password change, etc.
(631 to 641) and (643, 645 to 666)	4727 to 4737, 4739 to 4762	User Group Changes	Identifies all the changes done on an user group such as adding or removing a global or local group, adding or removing members from a global or local group, etc.
672, 680	4768, 4776	Successful User Account Validation	Identifies successful user account logon events, which are generated when a domain user account is authenticated on a domain controller
675, 681	4771, 4777	Failed User Account Validation	Identifies unsuccessful user account logon events, which are generated when a domain user account is authenticated on a domain controller
682, 683	4778, 4779	Host Session Status	Identifies the session reconnection or disconnection

Using EventLog Analyzer you can archive or store these Windows event logs, and also generate event log reports in real-time. You get instant access to wide variety of reports for events generated across hosts, users, processes, and host groups. You can also obtain pre-defined compliance reports to meet HIPAA, GLBA, PCI, and Sarbanes-Oxley audit requirements.