Objective 4.1 Monitor and Analyze Events

The Event log can be configured to record a vast amount of information about the system. Being able to sift that data to find a particular set of events can be difficult unless you know how to filter the logs to show only the type of information in which you are interested.

Events in the Event log can be filtered in several ways. The first is by specifying the event type, which can be Information, Warning, Error, Success Audit, or Failure Audit. The next type is the Event Source, the system or service on the Windows Server 2003 server that has generated the event. The category lists which subsystem of the server has generated the event. Events can also be filtered by Event ID, User name, Computer name, and can be limited to a specific set of dates. Efficiently filtering the Event log can quickly allow an administrator to view only the relevant data and not have to wade through events that are irrelevant to the task at hand.