Host: Event logs. 2 2
In this lesson we are going to talk about event logs, 3 3
and event logs are logs that are created 4 4
by your operating system on each and every client 5 5
or server to record how the users 6 6
and the software interact with that system. 7 7
Now, the format of these event logs is going to vary based 8 8
on the operating system you're dealing with. 9 9
Each one uses its own format 10 10
so whether you're using Windows or Mac or Linux 11 11
it's going to be different. 12 12
In this lesson, we are going to focus on Windows logs 13 13
and the next lesson we'll talk more about Mac and Linux. 14 14
Now Windows logs have five different categories 15 15
of events that you can find inside your Windows event logs. 16 16
These are application, security, system, setup 17 17
and forwarded events. 18 18
The first one is application 19 19
and application focuses on events that are generated 20 20
by applications and services. 21 21
For instance, if you tried to start up a printer service 22 22
and that wouldn't run, that would actually get logged 23 23
as an application event inside of the Windows event log. 24 24
The second one we have is security, 25 25
and security is going to conduct things like audit events 26 26
things like failing to log on or access being denied 27 27
to a file, anything that has to do with security 28 28
this is going to go into your security event logs. 29 29
Then we have system, system is our third one 30 30
and this is any events that's shared 31 31
by the operating system and its services. 32 32
So if Windows has an error or one of the Windows services 33 33
has an error it's going to get logged underneath system. 34 34
This would be things like your storage volume 35 35
health check fails or something like that. 36 36
And then we have our fourth one, which is setup. 37 37
This is going to be events that are generated 38 38
during the installation of Windows, so if you have any kind 39 39
of errors or events that need to be logged during the setup 40 40
that's going to happen under the setup category. 41 41
And our fifth and final one is forwarded events, 42 42
these are events that are sent to that local host 43 43
that you're looking at from other computers 44 44
and we'll talk a little bit more 45 45
about that towards the end of this lesson. 46 46
Now, in addition to these five categories 47 47
we also have four categories 48 48
of severity for each of these events. 49 49
And this is all going to happen again 50 50
inside your Windows event logs. 51 51
These are information which is used 52 52
for successful events, warnings, which is used 53 53
for events that aren't necessarily a problem 54 54
but they could end up being a problem in the future. 55 55
For instance, you're getting low on disk space, errors, 56 56
which are events that have significant problems 57 57
and could result in reduced functionality and audit success 58 58
and failure, which is an event that indicates a user 59 59
or service either fulfilled 60 60
or did not fulfill the system's audit policies. 61 61
These are kind of unique inside of your security log 62 62
and you're not going to see them in some of the other logs. 63 63
Now, in addition to all that, each time you look at an entry 64 64
inside your event log, you're going to get some details. 65 65
You're going to get the name of the event, the details 66 66
of any errors that occurred, the event ID, 67 67
the source of the event, and a description of what 68 68
the warning or error means. 69 69
This should all be reviewed from you because we did cover 70 70
this back in A+ and security plus as part of 71 71
those exam objectives. 72 72
Now, the final thing I want to talk about is forwarding 73 73
and we talked about forwarded events as the fifth category. 74 74
Now forwarded events is a relatively new concept 75 75
that was added inside the modern Windows systems, 76 76
Windows eight and beyond. 77 77
Now this provides event subscriptions 78 78
that forwards all the events to a single host 79 79
and allows for a more holistic view 80 80
of network events using an XML formatted message that ends 81 81
in the .evtx extension for event. 82 82
Now, the idea here is that we want to be able 83 83
to take all the events from all of our systems 84 84
and send them to a centralized server 85 85
just like we talked about with SIEMs. 86 86
Well, with SIEMs, you might have used an agent 87 87
and installed something on the system. 88 88
As of Windows eight and Windows 10, that has now been built 89 89
into the operating system by Microsoft, 90 90
so you don't need to have a separate agent, 91 91
there's one built into the operating system 92 92
and that's what this event forwarding is all about.