## Auditing and Logging Integration

Contrary to what you might expect, there is no center that controls which events are audited under Windows NT. You have to select the appropriate administration tool for the event you wish to track and activate the tool to enable auditing. For example, to control printer auditing, you use the Printers folder. To control user and group auditing, you use the User Manager program.

All auditing and logging of messages are stored in Event log files that can be viewed through the Event Viewer program. Event Viewer exports Event logs in ASCII format allowing them to be processed on a UNIX computer.

Another surprising Windows NT feature is that it is not straightforward to collect events from multiple computers in a single location. This is relatively easy using the UNIX syslog facility, but Windows NT requires some indirect methods. This includes transforming events into simple network management protocol (SNMP) traps and collects them using an SNMP console or by running third-party programs on each remote computer that in turn relay event information to a central site. A UNIX-based SNMP console, such as Hewlett-Packard's OpenView, can collect SNMP events from Windows NT computers.

©1997 Microsoft Corporation. All rights reserved. Legal Notices.
Last Updated: December 1, 1997