Event view LOGS

[Ryan]

I want to manage my eventview logs effectively can someone give me a
production solution that they use.
ie do you just save it and start another or ?

thanks

 

[Cary Shultz [A.D. MVP]]

Ryan,

I might suggest that one step that you could take would be to increase the
size of the logs. You can do this with GPOs. What specifically do you have
in mind?

HTH,

Cary

 

[Brent Westmoreland]

Depending on what you mean by "manage the eventview logs effectively"
MACS would probably be a good solution for you. Unfortunately, it is
not in a full swing of production yet as the software is still beta.
To my understanding it is coming soon.

www.windowsboston.com/downloads/ doc/MACS_beta_Overview.doc


The summary of the whole thing is that you install Microsoft Auditing
Collection System on a win2k3 server. A Sql 2000 database instance on
a seperate server (2k or 2k3) and the Agent on all of the servers you
want to monitor.

Then the Agent will parse the event log and update the MACS instance in
realtime with your event log info, allowing you to do phenomenal things
with all of the data you have now collected.

Hope that helps.