TABLE OF CONTENTS A critical aspect of ensuring system stability is the ongoing monitoring and analysis of System event logs. Like UNIX systems, Microsoft Windows operating systems (OSs) have logging features that can aid you in diagnosing system problems and ensuring that your system is optimized and secure. Most administrators don t make full use of these features, however, due to the extensive amount of time it takes to read through thousands upon thousands of log file entries. This makes it difficult for administrators to take a proactive approach to systems administration by eliminating problems before they become critical. Throughout this chapter, we will be discussing how Log Parser can help with this task and make a tedious task not only easy, but fun as well.
When analyzing the overall performance and functionality of servers, you should always keep user activity in mind. Unusual user activity can be an indicator of system problems or security issues. By analyzing the user activity reported in your system logs, you can determine trends in logon/logoff activity, potential authentication problems, and hacking activity.
Monitoring user access to the system will allow you to trend out system usage and determine peak usage times as well as identify problem areas for users authenticating with the server. We will be going over a few techniques you can use to easily view and analyze this data using Log Parser.
Another important aspect in determining relevant events in your system logs is determining which behavior is benign...
