Publisher's Synopsis
Event logging is a facility used by computer systems to record the occurrence of significant events. An "event" is any change that occurs in a system -- for example, a user logon, an addition to a file, or a change to a user's privileges. Because a computer system may experience hundreds or thousands of events each second, it is important to distinguish which events require the immediate attention of a system administrator, which should be recorded as entries in the system's event log for later analysis, and which can be safely ignored.Event logs provide a centralized collection point for all kinds of error reports, system alerts, diagnostic messages, and status messages generated by a system. This book describes the characteristics of these messages, why they are important, and how you can access them and act upon them. Event logs are particularly important to system security and problem troubleshooting. Windows NT systems generate three distinct types of event logs:
- Security log. Stores reports of security-related events -- for example, a user has written to a file or there has been a change in a user's privileges.
- System log. Stores reports generated by system components, including drivers and services -- for example, a device failed, a driver failed to load, or a memory allocation or I/O error occurred.
- Application log. Stores reports on all other events -- for example, an internal application error (such as a failure to allocate memory) occurred, or a file download aborted.
