RE: Re: Syslog and Windows

 
> That would amount to reading the FAQ of the list!  Talk about 
> a "duh".  I have had LOTS of folks ask me about 
> this very subject.  Especially when I tell them their logs 
> are exposed to hacking.  Windows may not a decent 
> logging platform, (*cough* - 'scuse me) but it is pervasive.  
> Folks are having a lot of mischeivious fun, and no 
> one has a clue.  Put these logs on a central server, and at 
> least they will have something they can trust!

If I make take the substantial liberty of interpreting what Chris said, I
think that what he meant is that he wouldn't use a Windows box as a central
loghost, *not* that the logs produced by Windows systems themselves are
problematic (aside from any native support for syslog).

[If that's *not* what you meant, Chris, we may have to have it out with an
arm-wrestling match or something.]

It is, as far as I've seen, clear that syslog *server* implementations for
UNIX variants offer far more features and robustness than the syslog servers
for Windows, although I must confess to little experience with Windows
syslog servers. Mostly I'd worry about their ability to perform under load,
especially if they're moving syslog data into the pre-Vista Event Log
service.

>From the point of view of the logs themselves, I strongly defend my radical
opinion that there are many ways in which the Windows Event Log is easier to
use and more reliable than stock syslog:

- there's a well defined relationship between the audit/logging
configuration on Windows and the events that will be recorded by the Event
Log, which persists across different versions of the OS
- logging configuration on Windows is far more granular and simple than is
possible with /etc/syslog.conf
- messages generated by the Local Security Authority on Windows and stored
in the Security Event Log are much more tightly controlled than anything
managed by stock syslog, providing more reliable forensic data "out of the
box" than syslog data

Of course, it's hard to centralize cos it doesn't support syslog; it's more
work for developers precisely because it's more structured; and it takes a
bit more effort to get it out of the GUI and into a form that can be used by
grep :-)

They all have their pluses and minuses, and as Bill says, in this day and
age most IT workers will have to deal with log data from both platforms, not
to mention the various applications they all run.

That being said, I'm sticking with syslog-ng for my central repository ;-)

cheers - tbird