UltimateWindowsSecurity.com Forum / Ultimate Windows Security Forum / IT Audit / Windows Server / How to easily obtain Event Log activity metrics / Latest Posts

RE: How to easily obtain Event Log activity metrics

RandyFranklinSmith — Sat, 02 May 2009 18:50:46 GMT

I would suggest logparser; you will need to use the count(*) function and the group by clause.

The command will be something close to

logparser "select TimeGenerated, count(*) from security group by TimeGenerated"

But you will need to use the substring function on TimeGenerated to chop off the time and leave just the date. You can download logparser at http://www.microsoft.com/downloads/details.aspx?FamilyID=890cd06b-abf8-4c25-91b2-f8d975cf8c07&displaylang=en and there are examples of its use all over the Internet.

How to easily obtain Event Log activity metrics

ottermaton — Fri, 01 May 2009 17:17:48 GMT

How much log data and/or how many events is a given server creating in a typical day? In a typical week? At its peak moment (Monday morning)?

This question is of particular interest for Domain Controllers, and I don't know the answer. Are there any built-in Windows tools or interfaces for displaying this type of data? Or any simple (and free) third party tools for doing so?