1. SYSTEM ACTIVITY MONITORING
Course Code: CSCI-620
Course Description: OPERATING SYSTEMS SECURITY
Lecture 9: Session: 2
Duration: min
Lecture Unit: CSN1
Topic: Windows system activity monitoring
Author: Prof. Bill Mihajlović
Uvod
Lecture 9.2
Copyright © R. A. Mihajlovic, Brooklyn, NY, USA, 2009, Reproduction in any shape or form is prohibited.

2. CSCI-620 Operating systems security
Topics
Windows systems event manager
Inspecting events
Customizing event data report
Use Windows event manager to inspect systems log data
Configure event manager reporting GUI utility to selectively report event data
View log data
Lecture 9.2
© R. A. Mihajlovic, Brooklyn, NY, USA, 2009.
CSCI-620 Operating systems security

3. CSCI-620 Operating systems security
Windows system event
In Microsoft Windows XP, an event is any occurrence that is potentially noteworthy:
to direct user,
to other users,
to the operating system, or
to an application.
Lecture 9.2
© R. A. Mihajlovic, Brooklyn, NY, USA, 2009.
CSCI-620 Operating systems security

4. The Event Manager Utility
Event manager is managing system’s internal event related journal messages
Lecture 9.2
© R. A. Mihajlovic, Brooklyn, NY, USA, 2009.
CSCI-620 Operating systems security

5. Windows system activity logging
Windows systems events are recorded by the Event Log service, and their history is preserved in three log files:
Security (Secevent.evt),
Application (Appevent.evt), and
System (Sysevent.evt).
Event Viewer, a Microsoft Management Console snap-in supplied with Windows XP, allows you to:
review and
archive these three event logs.
Lecture 9.2
© R. A. Mihajlovic, Brooklyn, NY, USA, 2009.
CSCI-620 Operating systems security

6. System activity auditing
Security events are recorded in the Security log, Secevent.evt.
Monitoring security events is called security auditing.
The Application and System logs (Appevent.evt, Sysevent.evt) record application events and system events, respectively.
Monitoring these events is called systems auditing.
Lecture 9.2
© R. A. Mihajlovic, Brooklyn, NY, USA, 2009.
CSCI-620 Operating systems security

7. CSCI-620 Operating systems security
Control panel
Lecture 9.2
© R. A. Mihajlovic, Brooklyn, NY, USA, 2009.
CSCI-620 Operating systems security

8. CSCI-620 Operating systems security
Administrative tools
Lecture 9.2
© R. A. Mihajlovic, Brooklyn, NY, USA, 2009.
CSCI-620 Operating systems security

9. CSCI-620 Operating systems security
CLI shell command
Event Viewer may be started on the CLI command shell too.
Lecture 9.2
© R. A. Mihajlovic, Brooklyn, NY, USA, 2009.
CSCI-620 Operating systems security

10. Event log viewer General sources of event messages
Lecture 9.2
© R. A. Mihajlovic, Brooklyn, NY, USA, 2009.
CSCI-620 Operating systems security

11. Specific sources of event messages
Event Log Viewer
Message severity
Specific sources of event messages
General sources of event messages
Lecture 9.2
© R. A. Mihajlovic, Brooklyn, NY, USA, 2009.
CSCI-620 Operating systems security

12. Information event log line
Lecture 9.2
© R. A. Mihajlovic, Brooklyn, NY, USA, 2009.
CSCI-620 Operating systems security

13. CSCI-620 Operating systems security
Error Event Log Line
Lecture 9.2
© R. A. Mihajlovic, Brooklyn, NY, USA, 2009.
CSCI-620 Operating systems security

14. Warning Event Log Content
Lecture 9.2
© R. A. Mihajlovic, Brooklyn, NY, USA, 2009.
CSCI-620 Operating systems security

15. Inspecting event message content
Lecture 9.2
© R. A. Mihajlovic, Brooklyn, NY, USA, 2009.
CSCI-620 Operating systems security

16. Customized report view
Lecture 9.2
© R. A. Mihajlovic, Brooklyn, NY, USA, 2009.
CSCI-620 Operating systems security

17. Customized report view
Lecture 9.2
© R. A. Mihajlovic, Brooklyn, NY, USA, 2009.
CSCI-620 Operating systems security

18. Custom view & filter logs options
Report screen can be customized.
Lecture 9.2
© R. A. Mihajlovic, Brooklyn, NY, USA, 2009.
CSCI-620 Operating systems security

19. CSCI-620 Operating systems security
Homework
Write a short paper with screen shots on
Windows log files, and
Customizing Windows event management reports.
Lecture 9.2
© R. A. Mihajlovic, Brooklyn, NY, USA, 2009.
CSCI-620 Operating systems security

20. CSCI-620 Operating systems security
Homework
Comment 6 lines in the typical /etc/syslog.conf file.
Lecture 9.2
© R. A. Mihajlovic, Brooklyn, NY, USA, 2009.
CSCI-620 Operating systems security

21. CSCI-620 Operating systems security
Homework
Test m4 macro processor on dynamic configuration code in the /etc/syslog.conf file.
Lecture 9.2
© R. A. Mihajlovic, Brooklyn, NY, USA, 2009.
CSCI-620 Operating systems security

22. CSCI-620 Operating systems security
Homework
Install Linux in your free google cloud and start Linux command learning (For the final exam) and shell scripting.
Lecture 9.2
© R. A. Mihajlovic, Brooklyn, NY, USA, 2009.
CSCI-620 Operating systems security

23. CSCI-620 Operating systems security
The End
Lecture 9.2
© R. A. Mihajlovic, Brooklyn, NY, USA, 2009.
CSCI-620 Operating systems security