|
100% Developed & Supported in the state of Washington, U.S.A. |
|
|
February 6, 2007 Volume 2, Number 6 |
|
|
In This Issue · What's the Shortest Day of the Year? · Build a Filter to Differentiate User and System Logon Events · Syslog Receiver and Database Size Check us out! Popular TNT Links
Read more… "I don't see how anyone can run Windows machines without ELM. It's like watching TV without TIVO." See how companies worldwide are using ELM to proactively manage their environments Contact Us 2001
Main Street
Phone: 360.546.0878 Fax: 360.546.5017 Toll-Free: 877.546.0878 |
New Stuff at TNT SoftwareWin one of three free conference passes for TechMentor Orlando Go here and register to win one of three conference passes (valued at $1499.00) to TechMentor Orlando, March 26-30, 2007. The drawing will be held Monday, February 11 at noon Pacific time. For more information about the conference, go to the TechMentor Events web page. Getting ready for ELM 5.0 -
...and more! What's the Shortest Day of the Year?Trick question. I know... I gave the traditional answer, thinking the question was, "What's the day with the shortest number of hours of daylight?" - December 22, 2007, winter solstice, duh. But in 2007, the shortest day of the year is March 11th, the first day of Daylight Saving Time - 23 hours long. A little background: On August 8, 2005, President George W. Bush signed the Energy Policy Act of 2005. This Act changed the time change dates for Daylight Saving Time in the U.S. Beginning in 2007, DST will begin on the second Sunday in March and end the first Sunday in November. So why is this of interest to us? Suddenly those in the IT world are faced with another potential crisis the likes of Y2K, made more complex by the fact that while the U.S. and Canada are changing Daylight Saving Time dates, Mexico isn't. How does that affect TNT Software's ELM products? It doesn't. Built to run on the Windows platform, ELM solutions rely on the operating system time. To learn more about what Microsoft is doing to make Windows DST2007 compliant, go to this page. Build a Filter to Differentiate User and System Logon EventsWindows does not differentiate between User and System logon events, presenting a challenge to those of you who want to target more specific information about logon events. TNT Support suggests that you use Exclude Filters to specify which events you want excluded from a Notification Rule. In the ELM Console, click on an Include Filters or Exclude Filters container. F1 will open the Help file with detailed information about creating and configuring Event Filters including the syntax and available operators. Here's an example: You could modify your current filter and add the following string to the 'Username is:' field: !*NT AUTHORITY\SYSTEM* The NOT (!) operator should exclude any events that match that username when all other criteria of the event is matched. Therefore, the only events in this filter that would trigger the notification rule are the ones that come from all users except the NT Authority\System account. Part of the solution should include testing and observation – perform a logon and immediately examine the Active Directory logs to see if the logon is recorded. If it is, ELM can collect that event and you can use it to build an appropriate filter. Syslog Receiver and Database SizeIf you are receiving syslog events in ELM, you may see the ELM database growing rapidly. Since ELM doesn’t use a Monitor Item to receive and collect Syslogs, it is not possible to filter that data in the same way events from Windows Event Logs are filtered. So when the Syslog Receiver is enabled in ELM, ELM receives all traffic arriving at port 514. While some devices will allow a degree of configuration for what is included in Syslog messages, most devices send everything. In order to control database growth associated with Syslogs, TNT Support suggests that you place an aggressive pruning rule in your ELM Database Settings to prune syslog messages more frequently. To do this, go to the Database Settings wizard found in the ELM Server contextual menu under "All Tasks", enable the Archive Database if you haven't already, and Add Alert and Event Pruning and Archiving Criteria that filter specifically for the syslog data, perhaps making retention of that data shorter than the ELM defaults. NOT Strictly Business
February 6th in History
|
