Can I do this (event related) task in batch ?

[Guest]

I already automate a number of tasks that I perform on a regular basis using exporter. However, I am having problems with this particular one.

We were having problems with identifying locking and unlocking of accounts. We came up with a solution of right clicking on the PDC and selecting "View Events".

We then view events of type 644, then use CTRL-C to append them to a file. We then do the same with events of type 626.

This works completely well and the end result is a file containing both details of the account becoming locked and another of the account being unlocked.

We then archive and clear the event logs using another piece of software that we have (Security CeNTre...)

The problem that we have is that we do this when we come in at approx 8:30 am. Between dumping the 644 and 626 events and clearing the events, more accounts can become locked or be unlocked and potentially be missed from the file.

We can schedule the archive / clearing of logs but is there a way of automating the task that we perform in Hyena to dump the 644 & 626 events to file ????????

Cheers,
Andrew Whitton

[kstanush]

Re: Can I do this (event related) task in batch ?

Unfortunately, I don't know of a way to do this in Hyena. There is DumpEvt (www.somarsoft.com), but I don't think that it can filter on event ID. DumpEvt is free. A better option might be to get an event consolidating software like Event Log Monitor (www.systemtools.com/elm) to do this entire task. I'm not trying to sell more software here, but I just don't know of another way to do this...

[Guest]

Re: Can I do this (event related) task in batch ?

Thanks for reply. We have looked at ELM but we might struggle to justify the cost - especially as we have already purchased another tool in that area.

After much fumbling around we have found the information provided via HYENA to be the most useful that we have found in the quickest and easiest manner.

I think we are just going to have to do this as soon as we get in. Then take the hit that if an account locks / is unlocked in the 2 minutes gap we may not have it documented (although we have the archived event)

Thanks anyway,
Cheers,
Andrew.

[Guest]

Re: Can I do this (event related) task in batch ?

I have had a look at DUMPEVT which I had downloaded but not yet used and I may be able to use this. If I schedule a task to do the command line of

"dumpevt.exe /logfile=SEC /outfile=FILE.XLS /computer=PDCNAME"

This will dump ALL events from the security log to a file. Then with a bit of VB or an EXCEL Macro I should be able obtain the info that I want...

Thanks
Andrew