Network Security Hacks

Integrate Windows into Your Syslog Infrastructure

Keep track of all of your Windows hosts the Unix way.

It’s hard enough to keep tabs on all the Event Logs for all your Windows hosts, but it’s even more difficult if your propensities predispose you to Unix. After all, Unix systems keep their logs in plain text files that are easily searchable with common shell commands. This is a world apart from the binary logs that Windows keeps in its Event Log. Wouldn’t it be nice if you could have your Windows machines work more like the Unix machines that you’re used to? Someone has already thought of it and has written a free Windows service that lets us do just that.

Ntsyslog (http://ntsyslog.sourceforge.net/) is a freely available service written for Windows that allows you to log to a remote syslogd. To set it up, just download and extract the ZIP file, and then copy the NTSyslogCtrl.exe and ntsyslog.exe files into your %SystemRoot%\system32 directory.

To install the service, open up a command prompt and run this:

C:\> ntsyslog -install

To verify that it was installed, open up the Administrative Tools Control Panel applet and double-click the Services icon. Then scroll around and look for the NTsyslog service. You should see something similar to Figure 4-1.

Figure 4-1. The Services Control Panel applet with the NTsyslog service shown

By default, NTsyslog installs itself to run under the Local ...