SYSTEM ACTIVITY MONITORING Course Code: CSCI-620 Course Description: OPERATING SYSTEMS SECURITY Lecture 9: Session: 2 Duration: 120 min Lecture Unit: CSN1 Topic: Windows system activity monitoring Author: Prof. Bill Mihajlović Uvod Lecture 9.2 Copyright © R. A. Mihajlovic, Brooklyn, NY, USA, 2009, Reproduction in any shape or form is prohibited.

CSCI-620 Operating systems security Topics Windows systems event manager Inspecting events Customizing event data report Use Windows event manager to inspect systems log data Configure event manager reporting GUI utility to selectively report event data View log data Lecture 9.2 © R. A. Mihajlovic, Brooklyn, NY, USA, 2009. CSCI-620 Operating systems security

CSCI-620 Operating systems security Windows system event In Microsoft Windows XP, an event is any occurrence that is potentially noteworthy: to direct user, to other users, to the operating system, or to an application. Lecture 9.2 © R. A. Mihajlovic, Brooklyn, NY, USA, 2009. CSCI-620 Operating systems security

The Event Manager Utility Event manager is managing system’s internal event related journal messages Lecture 9.2 © R. A. Mihajlovic, Brooklyn, NY, USA, 2009. CSCI-620 Operating systems security

Windows system activity logging Windows systems events are recorded by the Event Log service, and their history is preserved in three log files: Security (Secevent.evt), Application (Appevent.evt), and System (Sysevent.evt). Event Viewer, a Microsoft Management Console snap-in supplied with Windows XP, allows you to: review and archive these three event logs. Lecture 9.2 © R. A. Mihajlovic, Brooklyn, NY, USA, 2009. CSCI-620 Operating systems security

System activity auditing Security events are recorded in the Security log, Secevent.evt. Monitoring security events is called security auditing. The Application and System logs (Appevent.evt, Sysevent.evt) record application events and system events, respectively. Monitoring these events is called systems auditing. Lecture 9.2 © R. A. Mihajlovic, Brooklyn, NY, USA, 2009. CSCI-620 Operating systems security

CSCI-620 Operating systems security Control panel Lecture 9.2 © R. A. Mihajlovic, Brooklyn, NY, USA, 2009. CSCI-620 Operating systems security

CSCI-620 Operating systems security Administrative tools Lecture 9.2 © R. A. Mihajlovic, Brooklyn, NY, USA, 2009. CSCI-620 Operating systems security

CSCI-620 Operating systems security CLI shell command Event Viewer may be started on the CLI command shell too. Lecture 9.2 © R. A. Mihajlovic, Brooklyn, NY, USA, 2009. CSCI-620 Operating systems security

Event log viewer General sources of event messages Lecture 9.2 © R. A. Mihajlovic, Brooklyn, NY, USA, 2009. CSCI-620 Operating systems security

Specific sources of event messages Event Log Viewer Message severity Specific sources of event messages General sources of event messages Lecture 9.2 © R. A. Mihajlovic, Brooklyn, NY, USA, 2009. CSCI-620 Operating systems security

Information event log line Lecture 9.2 © R. A. Mihajlovic, Brooklyn, NY, USA, 2009. CSCI-620 Operating systems security

CSCI-620 Operating systems security Error Event Log Line Lecture 9.2 © R. A. Mihajlovic, Brooklyn, NY, USA, 2009. CSCI-620 Operating systems security

Warning Event Log Content Lecture 9.2 © R. A. Mihajlovic, Brooklyn, NY, USA, 2009. CSCI-620 Operating systems security

Inspecting event message content Lecture 9.2 © R. A. Mihajlovic, Brooklyn, NY, USA, 2009. CSCI-620 Operating systems security

Customized report view Lecture 9.2 © R. A. Mihajlovic, Brooklyn, NY, USA, 2009. CSCI-620 Operating systems security

Customized report view Lecture 9.2 © R. A. Mihajlovic, Brooklyn, NY, USA, 2009. CSCI-620 Operating systems security

Custom view & filter logs options Report screen can be customized. Lecture 9.2 © R. A. Mihajlovic, Brooklyn, NY, USA, 2009. CSCI-620 Operating systems security

CSCI-620 Operating systems security Homework Write a short paper with screen shots on Windows log files, and Customizing Windows event management reports. Lecture 9.2 © R. A. Mihajlovic, Brooklyn, NY, USA, 2009. CSCI-620 Operating systems security

CSCI-620 Operating systems security Homework Comment 6 lines in the typical /etc/syslog.conf file. Lecture 9.2 © R. A. Mihajlovic, Brooklyn, NY, USA, 2009. CSCI-620 Operating systems security

CSCI-620 Operating systems security Homework Test m4 macro processor on dynamic configuration code in the /etc/syslog.conf file. Lecture 9.2 © R. A. Mihajlovic, Brooklyn, NY, USA, 2009. CSCI-620 Operating systems security

CSCI-620 Operating systems security Homework Install Linux in your free google cloud and start Linux command learning (For the final exam) and shell scripting. Lecture 9.2 © R. A. Mihajlovic, Brooklyn, NY, USA, 2009. CSCI-620 Operating systems security

CSCI-620 Operating systems security The End Lecture 9.2 © R. A. Mihajlovic, Brooklyn, NY, USA, 2009. CSCI-620 Operating systems security