One of the more challenging things about log management is trying to collect the vast amount of data that is generated in multi-site networks over limited bandwidth links.
To that end, we have developed a companion tool to our Event Archiver® software - the Importer™ tool for Event Archiver.
Basically, you can instruct all of your various Event Archiver installations to send compressed sets of log data in EVT/EVTX and comma-delimited formats to a computer running the Importer utility. You can use Microsoft Windows file shares or FTP to transport the compressed log file pairs as needed.
Once received, the Importer utility can decompress the log data and automatically import it into a central Microsoft SQL or Oracle database for analysis by our Event Analyst® software.
If you want to deploy a log management solution, but are struggling with the concept of consolidating your data over limited bandwidth pipes, this tool is the answer. It's also a better system than having to deploy an agent to every computer on your network; using the Importer system, you typically only need to deploy one instance of Event Archiver to each local network / branch office.
As far as bandwidth considerations go, by transmitting the data in compressed form, the bandwidth necessary is only 7 to 10% that of the uncompressed log files. We have clients who have successfully used this solution over satellite links, so it has been proven in the field.
For more information on the Importer utility for Event Archiver, including licensing costs, please visit http://www.doriansoft.com/importer
Tuesday, May 13, 2008
Wednesday, February 13, 2008
UltraAdmin Version 6 Now Available
As promised, version 6 of UltraAdmin® is now available for download from the Dorian Software website. This version is being made available at no charge to any network administrator who wishes to use it. For those organizations and individuals that need priority support for the product, you can purchase it here.
We've also made available a PDF file listing all of UltraAdmin's features.
The new features in Version 6 include the utility's support for Microsoft Vista™ (important for those admins who are using it on their workstations), support for EVTX and EVT event log reading when installed on Vista, and a new database query tool that can be used to comb through data exported by UltraAdmin into a Microsoft Access database.
A rather nice, but often overlooked feature we introduced in Version 5, is UltraAdmin's ability to manage startup programs on servers and workstations remotely. Specifically, UltraAdmin can manage Run key programs, BHOs, Winlogon notification packages, and Startup folder links. Consequently, UltraAdmin can be used to remove or limit some types of spyware or malware that hook these areas to ensure their load at startup.
For example, an administrator using UltraAdmin can:
1.) Locate the offending executable or DLL that is loaded at startup.
2.) Change the NTFS permissions on that executable or DLL remotely so that no one has access to the file.
3.) Reboot the workstation or server in question remotely.
4.) Delete the offending files after the system has been restarted, and delete the startup hooks referencing those files.
Obviously, some forms of spyware/malware are more tenacious than others, and will be substantially harder to remove. For powerful anti-spyware software, we recommend CounterSpy™ from our friends at Sunbelt Software. Still, UltraAdmin remains an excellent tool in the admin's arsenal, especially for spyware/malware that be surgically extracted in the manner mentioned above.
We've also made available a PDF file listing all of UltraAdmin's features.
The new features in Version 6 include the utility's support for Microsoft Vista™ (important for those admins who are using it on their workstations), support for EVTX and EVT event log reading when installed on Vista, and a new database query tool that can be used to comb through data exported by UltraAdmin into a Microsoft Access database.
A rather nice, but often overlooked feature we introduced in Version 5, is UltraAdmin's ability to manage startup programs on servers and workstations remotely. Specifically, UltraAdmin can manage Run key programs, BHOs, Winlogon notification packages, and Startup folder links. Consequently, UltraAdmin can be used to remove or limit some types of spyware or malware that hook these areas to ensure their load at startup.
For example, an administrator using UltraAdmin can:
1.) Locate the offending executable or DLL that is loaded at startup.
2.) Change the NTFS permissions on that executable or DLL remotely so that no one has access to the file.
3.) Reboot the workstation or server in question remotely.
4.) Delete the offending files after the system has been restarted, and delete the startup hooks referencing those files.
Obviously, some forms of spyware/malware are more tenacious than others, and will be substantially harder to remove. For powerful anti-spyware software, we recommend CounterSpy™ from our friends at Sunbelt Software. Still, UltraAdmin remains an excellent tool in the admin's arsenal, especially for spyware/malware that be surgically extracted in the manner mentioned above.
Friday, February 8, 2008
UltraAdmin Is Now Free, and Features LogRefiner Technology
When you take a bit of a hiatus from blogging, you need to resurface with a bang. To that end, we're excited to announce that UltraAdmin Version 6 will be released next week. The best part?
We're making it available FREE to any network administrator who wants to use it. Fully functional, uncrippled, comprehensive Windows domain and Active Directory management at your fingertips.
We will sell priority support plans for it at $99.00 USD per admin per year, for those who desire that level of assistance.
Some of the biggest Version 6 highlights:
1.) It now supports Microsoft Vista™
2.) It can read both live and saved EVT and EVTX log files when run on Microsoft Vista. Admins won't need to crank up two different versions of the Microsoft Event Viewer to view their logs. We've placed some of our amazing LogRefiner™ technology inside UltraAdmin to accomplish this.
3.) It has a built-in query tool that complements the UltraAdmin Reporter/Exporter module, allowing the administrator to quickly comb through the Microsoft Access databases that UltraAdmin can populate with domain objects and their properties.
We'll post more information on UltraAdmin - including a link to download it and a comprehensive feature listing - early next week.
We're making it available FREE to any network administrator who wants to use it. Fully functional, uncrippled, comprehensive Windows domain and Active Directory management at your fingertips.
We will sell priority support plans for it at $99.00 USD per admin per year, for those who desire that level of assistance.
Some of the biggest Version 6 highlights:
1.) It now supports Microsoft Vista™
2.) It can read both live and saved EVT and EVTX log files when run on Microsoft Vista. Admins won't need to crank up two different versions of the Microsoft Event Viewer to view their logs. We've placed some of our amazing LogRefiner™ technology inside UltraAdmin to accomplish this.
3.) It has a built-in query tool that complements the UltraAdmin Reporter/Exporter module, allowing the administrator to quickly comb through the Microsoft Access databases that UltraAdmin can populate with domain objects and their properties.
We'll post more information on UltraAdmin - including a link to download it and a comprehensive feature listing - early next week.
Wednesday, November 21, 2007
Tracking Software Installation and Removal Using Event IDs 11707, 11724, and 592
In these days of malware, spyware, and compliance regulations, a lot of admins are looking to track the installation of unauthorized programs, and/or the removal of required programs from client desktops. There are actually several events you can look for in both the Application Event Log and Security Event Log that will help you do this.
In the Application log, setup packages that use the Windows Installer to install themselves will create numerous events, all with an event source of MsiInstaller.
Event ID 11707 tells you when a install completes successfully, and also the user who executed the install package.
Event Type: Information
Event Source: MsiInstaller
Event Category: None
Event ID: 11707
Date: 11/9/2006
Time: 3:21:45 PM
User: DOMAIN\USER
Computer: COMPUTERNAME
Description:
Product: Event Archiver Enterprise -- Installation operation completed successfully.
Event ID 11724 tells you when a software package is removed successfully, again logging the user behind the operation.
Event Type: Information
Event Source: MsiInstaller
Event Category: None
Event ID: 11724
Date: 11/12/2007
Time: 7:50:13 PM
User: DOMAIN\USER
Computer: COMPUTERNAME
Description:
Product: Event Archiver Enterprise -- Removal completed successfully.
You can track both of these events in our Event Analyst software by setting up appropriate filters and building a custom report.
Also, if you want to correlate the name of the executable setup package that was executed to install a piece of software, turn on Process Tracking auditing on the relevant Group Policy Object for one or more computers (e.g. Domain Security Policy, Local Security Policy), and look for events with Event ID 592 in the Security log that occur around the time of the 11707 event in the Application log, e.g.
Event Type: Success Audit
Event Source: Security
Event Category: Detailed Tracking
Event ID: 592
Date: 11/9/2006
Time: 3:20:30 PM
User: DOMAIN\USER
Computer: COMPUTERNAME
Description:
A new process has been created:
New Process ID: 2816
Image File Name: \EvntArch.exe
Creator Process ID: 516
User Name: USER
Domain: DOMAIN
Logon ID: (0x0,0x3E7)
Event Analyst also has a built-in Process Usage report that is very useful for viewing all of the executable files that were loaded and unloaded on one or more systems for a given time frame. It automatically determines the executable files that are run the most frequently for any given user.
In the Application log, setup packages that use the Windows Installer to install themselves will create numerous events, all with an event source of MsiInstaller.
Event ID 11707 tells you when a install completes successfully, and also the user who executed the install package.
Event Type: Information
Event Source: MsiInstaller
Event Category: None
Event ID: 11707
Date: 11/9/2006
Time: 3:21:45 PM
User: DOMAIN\USER
Computer: COMPUTERNAME
Description:
Product: Event Archiver Enterprise -- Installation operation completed successfully.
Event ID 11724 tells you when a software package is removed successfully, again logging the user behind the operation.
Event Type: Information
Event Source: MsiInstaller
Event Category: None
Event ID: 11724
Date: 11/12/2007
Time: 7:50:13 PM
User: DOMAIN\USER
Computer: COMPUTERNAME
Description:
Product: Event Archiver Enterprise -- Removal completed successfully.
You can track both of these events in our Event Analyst software by setting up appropriate filters and building a custom report.
Also, if you want to correlate the name of the executable setup package that was executed to install a piece of software, turn on Process Tracking auditing on the relevant Group Policy Object for one or more computers (e.g. Domain Security Policy, Local Security Policy), and look for events with Event ID 592 in the Security log that occur around the time of the 11707 event in the Application log, e.g.
Event Type: Success Audit
Event Source: Security
Event Category: Detailed Tracking
Event ID: 592
Date: 11/9/2006
Time: 3:20:30 PM
User: DOMAIN\USER
Computer: COMPUTERNAME
Description:
A new process has been created:
New Process ID: 2816
Image File Name: \EvntArch.exe
Creator Process ID: 516
User Name: USER
Domain: DOMAIN
Logon ID: (0x0,0x3E7)
Event Analyst also has a built-in Process Usage report that is very useful for viewing all of the executable files that were loaded and unloaded on one or more systems for a given time frame. It automatically determines the executable files that are run the most frequently for any given user.
Tuesday, November 6, 2007
Free Software Offer For Early Vista/EVTX Log Format Adopters
As promised in our previous post on Event Analyst's full support for working with EVT and EVTX log files natively on Windows Vista™, we are making a special free software offer available to admins that wish to use Vista as their OS platform for log management.
Here are the details of the offer, directly from our sales division:
Here are the details of the offer, directly from our sales division:
Do you already have some Windows Vista machines generating EVTX logs? Great. We'd like to give you some software. That's right. At no charge. We're offering 5 server license packs of Event Archiver™ and Event Analyst™ bundled together. Basic email-based support is included with all licenses. If you wish to pick up an upgrade service or another of our more advanced support options, we can arrange for the purchase. Interested? Simply request more details at
http://www.doriansoft.com/evtxsoftwareoffer.
As you can gather, this is a fantastic promotion, as it allows you to gather event log data from both your non-Vista and Vista systems and report on that data by running Event Archiver and Event Analyst on a Microsoft Vista workstation. We're convinced that once you see the power of Dorian's LogRefiner™ technology in action, you'll be much more comfortable in putting forth a plan for log management for your larger migration to Microsoft Windows Vista and Windows Server 2008™. As we've stated numerous times before, our exclusive LogRefiner technology is here and ready for you whenever that migration begins.
Friday, November 2, 2007
Event Analyst Works With EVT and EVTX Files, Side-By-Side!
Greetings, gentle readers. It's been a while since our last blog post, but that's because we've been slaving on the Version 6 release of Event Analyst. And what a fantastic release it is!
Just like our Event Archiver release of a few months ago, this version of Event Analyst is completely Microsoft Vista™ compatible, and features our revolutionary LogRefiner™ technology. You can download it here: http://www.doriansoft.com/download.
We've already mentioned in a bunch of posts that trying to read saved, legacy EVT files on Windows Vista is quite a chore, with missing fields and information being quite common. In fact, a recent blog posting from the Performance Team at Microsoft shows you how to perform a whole bunch of contortions in an attempt to convert an EVT file to an EVTX file, with of course there being no guarantee that the converted log will parse properly when you attempt to read it.
Well here's the good news. Thanks to our pioneering LogRefiner™ technology, you can work with EVT and EVTX files natively and side-by-side when Event Analyst is installed to a Microsoft Vista computer. No weird conversions or intermediate steps are necessary, and you get all the data parsed correctly from both log formats the first time. For those admins who are attempting to run Windows Vista on their workstations, this is a big plus because now you can use Event Analyst as your preferred log reader/analysis tool/reporting tool for all of your systems and your saved EVT log files. You no longer need to convert EVT files or juggle both the Microsoft Classic Event Viewer and the new Vista Event Viewer when switching back and forth between EVT and EVTX files.
Here's a screenshot of both an EVT and EVTX log being viewed within Event Analyst 6 at the same time:
Again, bear in mind that this technology lets you work with active AND saved EVT files from your older operating systems all natively inside Vista. It's very cool stuff.
We'll have more information for you on this technology soon, including a very nice licensing promotion, so please stay tuned.
Just like our Event Archiver release of a few months ago, this version of Event Analyst is completely Microsoft Vista™ compatible, and features our revolutionary LogRefiner™ technology. You can download it here: http://www.doriansoft.com/download.
We've already mentioned in a bunch of posts that trying to read saved, legacy EVT files on Windows Vista is quite a chore, with missing fields and information being quite common. In fact, a recent blog posting from the Performance Team at Microsoft shows you how to perform a whole bunch of contortions in an attempt to convert an EVT file to an EVTX file, with of course there being no guarantee that the converted log will parse properly when you attempt to read it.
Well here's the good news. Thanks to our pioneering LogRefiner™ technology, you can work with EVT and EVTX files natively and side-by-side when Event Analyst is installed to a Microsoft Vista computer. No weird conversions or intermediate steps are necessary, and you get all the data parsed correctly from both log formats the first time. For those admins who are attempting to run Windows Vista on their workstations, this is a big plus because now you can use Event Analyst as your preferred log reader/analysis tool/reporting tool for all of your systems and your saved EVT log files. You no longer need to convert EVT files or juggle both the Microsoft Classic Event Viewer and the new Vista Event Viewer when switching back and forth between EVT and EVTX files.
Here's a screenshot of both an EVT and EVTX log being viewed within Event Analyst 6 at the same time:
Again, bear in mind that this technology lets you work with active AND saved EVT files from your older operating systems all natively inside Vista. It's very cool stuff.
We'll have more information for you on this technology soon, including a very nice licensing promotion, so please stay tuned.
Wednesday, October 3, 2007
New EVTX Log Format Whitepaper Released
Earlier this week, we released a new whitepaper that outlines many of the key changes in the new EVTX event log format found in both Microsoft Vista and Windows Server 2008. We've included some choice pull quotes below, but you can download the full version by registering here:
http://www.doriansoft.com/evtx
Again, to read the full version, please register here:
http://www.doriansoft.com/evtx
http://www.doriansoft.com/evtx
Beginning with Microsoft® Windows Vista™ and Windows Server® 2008, Microsoft has completely redesigned its event log format. This new EVTX file format stores event log records as a stream of binary XML records. Accessing data in the new EVTX files requires the use of a new application programming interface that is not available in older Windows operating systems. In addition, the number of, structure of, and data within the fields in the EVTX log records has changed significantly.
Because the new Windows Event Log API functions are only available inside Windows Vista and later operating systems, legacy Windows operating systems like XP and 2003 cannot read previously saved EVTX files at all - there is simply no forward compatibility for consuming saved EVTX files. And while the legacy Event Log API can be used to read some of the events from an "active" EVTX file (that is to say an EVTX file currently being maintained by the EventLog service on a Vista machine), it cannot properly read and parse some events recorded by the new API.
In summary, both forward compatibility to EVTX files from legacy Windows operating systems and backward compatibility to EVT files are severely hampered, if available at all. As a result, organizations that rely on their own scripts and automation techniques may be tempted to develop two different systems for log management - one supporting legacy EVT files on legacy operating systems, and another supporting EVTX files on Windows Vista and Windows Server 2008. Such a strategy has the potential to decentralize log collection and reporting, as well as substantially increase costs over time.
Again, to read the full version, please register here:
http://www.doriansoft.com/evtx
Subscribe to:
Posts (Atom)
