What Was Microsoft Thinking?

March 20th, 2007 Posted in Rants, Windows Server

Windows I’m generally not one to bash on Microsoft.  Support of their OSes pays my bills, so I have a hard time hating it.  Let’s face it, Unix & Linux are great, stable, flexible, will do everything you ask of them, and are the only way to go when it comes to server operating systems.  Unfortunately until someone can create a GUI that’s usable by users of all ability levels and that can obscure the underlying filesystem,  it just isn’t going to catch on as a ubiquitous desktop operating system.  The Mac fanboys are likely going to tear me a new one in the comments here proclaiming that Apple has done just that, but let’s face it, there are far fewer machines running OS X than there are Windows.  The Mac has it’s place that’s for sure, and it’s gaining ground, but for now Windows is still the reigning champ.  I never really had any major complaints about Windows (other than the occasional BSOD, driver issues, and less than perfect security) but that came to an abrupt end last week.  Whoever designed the event system for Windows Server needs to die in a fiery car crash.

It came to our attention last week that one of our domain admins had their password compromised by a student.  As the AD administrator, it was my responsibility to gather the necessary information for the investigation and prosecution of the offending punk.  Other than taking forever because the security log is 500 MB so we can can keep more than a day’s worth of events, limiting the events to a particular username was easy.  Here’s my first complaint: why in god’s name wouldn’t Windows Server implement log rotation like every other sane operating system and server application?  It seems the only way to do log rotation is with a custom script or 3rd party application.

Things got rough when I was asked to determine who logged into the computer in question as well as the computers around it from a few hours before the incident to an hour after.  The good news is that there is a computer field in the event viewer so in theory I could just search on the computer names.  The bad news is that the only computer name that shows up in that column is the name of the domain controller … what’s the point?  In the message content of the logon event (Event ID 540) is the IP address of the client making the logon request and the username. Hallelujah!  All the info I need is there.  But here’s the rub; in all of their infinite wisdom, Microsoft didn’t put a mechanism in for searching this information … thanks a lot guys.  So now how am I supposed to filter a log that’s just a tad over 500MB to find logons for 5 machines during a 5 hour period?

Enter log parser 2.2.  This is a tool created by Microsoft specifically for parsing event logs (intuitive name eh?) and providing them in snazzy formats like text, comma separated values, and even HTML.  Log parser uses SQL queries to extract the information you’re looking for from the logs.  After stumbling into this, I thought I had hit the motherload, that is until I tried to run it.  It’s a command line only tool and has nearly zero documentation.  The sql queries aren’t self explanatory even when you figure out how to formulate one.  A prime example of this is the “strings” field which tokenizes the event message based on a delimiter.  Sounds good right?  Well not all log messages are in the same format, so the field that gives you an ip address for a logon event, doesn’t give you anything for a logoff event.  Without being an sql guru, it would be extremely difficult to get a list of all log on and log off events together.

I finally formulated two queries to extract the data I needed, one for logons and one for logoffs, and started tracing back the events by time.  That’s about the time I nearly flipped my lid.  There were logon and logoff events for the same user from the same computer at exactly the same second!  How does that happen?!?  After doing some searching on Event 538, I finally found a document that explained that it was a logoff event, but that it should never be trusted, and that it’s nearly impossible to tell when a logoff actually occurred.    Why is this so hard?  Shouldn’t it be easy to contact the domain controller when the user clicks “log off” and register and event with the username, computer name, and ip address?  Barring the occasional situation where a user pulls the plug, or there’s a power or network outage, this should be pretty reliable.  It’s not even possible with event viewer to filter the log and then print or export the full content of the error message with the details, you can only get the time, type of error, event id, and name of the computer that it occurred on.  It honestly seems like logging was a complete afterthought to the OS design. 

I’m currently in the process of exploring Microsoft Operations Manager 2005 (MOM 2005), hoping that it will help remedy this problem.  Just the promise of a central logging facility and alerts is a major step forward.  With any luck, it will also make analyzing those logs much easier than it is currently with the event viewer or log parser.  If you’ve got any tips, tricks, or suggestions on 3rd party software to make life easier in this respect, please leave a comment; I’d love to hear them.

tags: , , , , , , , , , ,

Related:





  1. One Response to “What Was Microsoft Thinking?”

  2. By luke on Jan 10, 2008

    I use ntsyslog (http://ntsyslog.sourceforge.net/) on all of my windows servers and log to a linux server. This makes life very easy because not only is syslog a standard format so you can find many parsers, but I like having the logs in two places, just in case the windows box gets rooted and someone deletes the logs or whatnot.

Post a Comment

Story Pulse

graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.graph element.

2,946 total reads, averaging 5 daily
stats powered by bsuite


Incoming searches for this post: windows (17) - logparser graph (10) - logparser delimiter (10) - computer users suck (5) - event id 540 (3) - ntsyslog vista (3) - event viewer 538 (3) - all (3) - Windows 2003 Event Log Rotation (2) - 2003 rotate event logs (2) - logparser chart types (2) - export event viewer script (2) - Rotate Windows Security Log (2) - windows security log rotation (2) - logparser chart (2) - security log ID 538 540 many (2) - exporting eventvwr log (2) - event 538 computername$ (2) - eventvwr log rotate (2) - event viewer log on and log off in the same second (2) - script to rotate windows event log (2) - sql event 538 (2) - microsoft operations manager sucks (2) - eventvwr export filter (2) - "log parser" "log on" "log off" (2) - event viewer 540 and 538 (2) - server 2003 not getting 540 events (2) - NTSyslog on Vista (2) - server 2003 event viewer log file rotation (2) - mom "logon event" 540 (1) - logparser sql (1) - why does Microsoft Operations Manager suck (1) - computername$ "event ID 540" "event ID 538" (1) - "parsing event logs" (1) - event viewer logparser Computername (1) - export windows event viewer logs parser (1) - sql event logs rotate (1) - logparser graph queries (1) - logging domain logoffs (1) - windows server 2003 event log rotation (1) - events 538 and 540 on my print server from one computer (1) - can you change the delimiter in log parser 2.2 (1) - why are there logon and logoff events at the same time? (1) - "mom" + "logon event" (1) - event 538 user name computername$ (1) - Windows xp event id 538 540 (1) - windows-server log rotation (1) - events 538 and 540 explained (1) - Windows 538 540 (1) - logparser after hour logons (1) - event id 540 and event id 538 from one computer (1) - 540 event logs computername$ (1) - logparser mom (1) - event id 538 all users get logoff (1) - windows xp event 540 different computer (1) - microsoft windowslogo (1) - logparser more than one eventid (1) - event id 540 538 server 2003 (1) - logparser+user logon event ids (1) - windows mom 2005 parsing events details (1) - catch windows logout events (1) - "Incoming searches for this post (1) - archiving unix logs over 500MB (1) - log parser logged on user computer name (1) - using log parser to rotate windows log (1) - +windows +2003 +server +domain +controller +event +id 538 +540 (1) - event 538 username$ (1) - parse user out of event viewer (1) - event id 540 login gui (1) - event 540 microsoft (1) - event id 538 (1) - server 2003 event id 538 (1) - Event Log full 538 & 540 (1) - Event 540 Computername$ (1) - "windows vista" "what was microsoft thinking" (1) - logparser, export event viewer (1) - event viewer id 540/538 (1) - event 540+event viewer+sql (1) - rotate security log and event viewer (1) - "export windows event viewer "command line (1) - event id 538 not logged windows 2003 (1) - windows catch end process logoff event (1) - logparser one user logon log (1) - 2003 server event 540 (1) - export windows events parse (1) - Username$ event 540 (1) - Event Viewer EventID 540 (1) - event viewer log rotation script for Windows (1) - Event ID: 540 occurs during logoff (1) - user logoff events domain controller (1) - event id 540 explained (1) - event id 538 server computer (1) - Event ID 540 computername$ (1) - event id 540 security explained (1) - windows 2003 event 540 (1) - windows event 540 logging (1) - "event viewer" 538 (1) - Log parser 2.2 gui (1) - parse event viewer (1) - Windows Logout event (1) - events xp 540 538 (1) - logoff events not logged (1) - event log archiving with MOM 2005 (1) - microsoft server 2003 event viewer event ID 540 (1) - event id: 540 os x ad login (1) - log parser 2.2 graph (1) - logparser logon logoff different domain controller (1) - logparser "chart types" (1) - event ID 538 sql 2005 (1) - export windows 2003 event command (1) - security log full event 540 538 windows xp (1) - error event 538 (1) - full security log 2003 538 (1) - linux event viewer parser (1) - server 2003 event id 538 and 540 (1) - user logon/logoff chart (1) - "log parser" beispiel login logoff microsoft (1) - logparser logon logoff events (1) - microsoft event viewer 538 (1) - export event log command line "Windows 2003" (1) - Event 540 what ip (1) - determine logged on users sql 2005 (1) - event viewer rotate for windows (1) - windows 2003 538 540 event (1) - event id 538 computername (1) - event id 538 computername$ (1) - event 538 user computer name $ (1) - LogParser Logon/Logoff (1) - vmware EVENT ID 540 (1) - Windows Event 540 domain admin (1) - windows server; rotate event viewer logs (1) - logparser find logon eventviewer (1) - user logoff 538 (1) - windows 2003 event log file rotation (1) - why macs suck.com (1) - event id 538 540 "server 2003" (1) - many 538 and 540 event ids (1) - windows "log rotation" (1) - "print server" logparser (1) - 2003 print logs export eventvwr (1) - export event logs "windows 2003" script (1) - logparser archiving (1) - windows event viewer rotate logs (1) - mom event id 540 (1) - logparser "print server" (1) - windows log rotation script (1) - "security log full" Windows 2003 (1) - windows event log rotate events (1) - event viewer id 538 540 (1) - "540 event" eventid (1) -