Interesting Post: Tracking Install/Uninstall Thru Logs

A quote: "In these days of malware, spyware, and compliance regulations, a lot of admins are looking to track the installation of unauthorized programs, and/or the removal of required programs from client desktops. There are actually several events you can look for in both the Application Event Log and Security Event Log that will help you do this." The Windows events involved are

Read on.

On Interpreting Windows Events - Comprehensive

This piece from Eric "Event Logger" Fitzgerald has pointers to more lists of Windows event information than you ever, ever, ever, ever :-) wanted to look at.

Examples are:

• Windows NT events: "Security Event Descriptions"
• Windows 2000 security events: two articles
• Windows Server 2003 events at Technet Events & Errors Message Center and "complete list of WS03 security events: chapter 4 of the Windows Server 2003 Security Guide"
  
• "Windows Server 2008 events are self-documenting"

Eric also reveals the horrible uber-reason why some of Windows events have no documentation (oh, horror!): "... we count the number of hits for each OS Version/Source/Event ID combination and then our writing teams pester the component owners to populate that content."

More On LASSO and Windows Logging

Here is a small blurb that I did for CNET on LASSO (our open-source agentless Windows-to-syslog collector) and Windows log collection. BTW, a new version of LASSO is out.

One thing to keep in mind is that you don't need LogLogic appliances to use LASSO: it can forward events to syslog-ng or other syslog destinations. However, if you do need more than a syslog server, LASSO works perfectly with the appliances as well.

List of Utilized Windows Logging Tools

List of popular Windows logging tools on Catalyst Community. OSSEC and many low-end commercial tools are mentioned.