Microsoft Windows Server 2008 Log Configuration Guide

Transcription

1 Microsoft Windows Server 2008 Log Configuration Guide Docu Release: March 2012 Part Number: LL ELS This manual supports LogLogic Microsoft Windows Server 2008 Release 2.0 and later, and LogLogic Software Release 5.1 and later until replaced by a new edition.

2 2012 LogLogic, Inc. Proprietary Information Trademarks This docu contains proprietary and confidential information of LogLogic, Inc. and its licensors. In accordance with the license, this docu may not be copied, disclosed, modified, transmitted, or translated except as permitted in writing by LogLogic, Inc. LogLogic and the LogLogic logo are trademarks or registered trademarks of LogLogic, Inc. in the United States and/or foreign countries. All other company or product names are trademarks or registered trademarks of their respective owners. Notice The information contained in this docu is subject to change at any time without notice. All warranties with respect to the software and accompanying docuation are set our exclusively in the Software License Agree or in the Product Purchase Agree that covers the docuation. LogLogic, Inc. 110 Rose Orchard Way, Ste 200 San Jose, CA Tel: Fax: U.S. Toll Free:

3 Contents Preface About This Guide Technical Support Docuation Support Conventions Chapter 1 Configuring LogLogic Support for Microsoft Windows Server 2008 Log Collection Microsoft Windows Server 2008 s Overview Prerequisites Configuring Microsoft Windows Installing and Configuring Project Lasso Configuration of Lasso Enterprise Configuration of Snare Collector Snare Filtering Configuration Enabling the LogLogic Appliance to Capture Log Data Configuring Auto Identification in the LogLogic Appliance Adding Microsoft Windows Server Device Verifying the Configuration Chapter 2 How LogLogic Supports Microsoft Windows Server 2008 How LogLogic Captures Microsoft Windows Server 2008 Data LogLogic Real-Time Chapter 3 Troubleshooting and FAQ Troubleshooting The logs are not showing in the reports: Frequently Asked Questions How does the LogLogic Appliance collect logs from Microsoft Windows? What access permissions are required? How do I configure logging on Microsoft Windows? What steps are required if the LogLogic Appliance fails to collect security log events from Microsoft Windows Server 2008? Appendix A Reference LogLogic Support for Microsoft Windows s Microsoft Windows Server 2008 Log Configuration Guide 3

4 4 Microsoft Windows Server 2008 Log Configuration Guide

5 Preface About This Guide The LogLogic Appliance-based solution lets you capture and manage log data from all types of log sources in your enterprise. The LogLogic support for Microsoft Windows enables LogLogic Appliances to capture logs from machines running Microsoft Windows Server Once the logs are captured and parsed, you can generate reports and create alerts on Microsoft Windows Server 2008 s operations. For more information on creating reports and alerts, see the LogLogic User Guide and LogLogic Online Help. Technical Support LogLogic is committed to the success of our customers and to ensuring our products improve customers' ability to maintain secure, reliable networks. Although LogLogic products are easy to use and maintain, occasional assistance might be necessary. LogLogic provides timely and comprehensive customer support and technical assistance from highly knowledgeable, experienced engineers who can help you maximize the performance of your LogLogic Appliances. To reach LogLogic Customer Support: Telephone: Toll Free, US LOGS (5647) Toll Telephone: Toll Free, Canada LOGS (5647) Toll Telephone: Toll Free, Mexico LOGS (5647) Toll Telephone: Toll Free, United Kingdom Toll Telephone: Toll Free, Mainland Europe Toll Telephone: Toll Free, Japan C Toll Not Available Telephone: Toll Free, Japan KDD Toll Not Available Telephone: Toll Free, Brazil Toll Not Available support@loglogic.com You can also visit the LogLogic Support website at: When contacting Customer Support, be prepared to provide: Your name, address, phone number, and fax number Your company name and company address Your machine type and release version A description of the problem and the content of pertinent error messages (if any) Microsoft Windows Server 2008 Log Configuration Guide 3

6 Docuation Support Conventions Your feedback on LogLogic docuation is important to us. Send to if you have questions or coms. Your coms will be reviewed and addressed by the LogLogic technical writing team. In your message, please indicate the software name and version you are using, as well as the title and docu date of your docuation. LogLogic docuation uses the following conventions to highlight code and command-line eles: A monospace font is used for programming eles (such as code frags, objects, methods, parameters, and HTML tags) and system eles (such as filenames, directories, paths, and URLs). A monospace bold font is used to distinguish system prompts or screen output from user responses, as in this example: username: system home directory: home\app A monospace italic font is used for placeholders, which are general names that you replace with names specific to your site, as in this example: LogLogic_home_directory\upgrade\ Straight brackets signal options in command-line syntax. For example: ls [-AabCcdFfgiLlmnopqRrstux1] [-X attr] [path...] 4 Microsoft Windows Server 2008 Log Configuration Guide

7 Chapter 1 Configuring LogLogic Support for Microsoft Windows Server 2008 Log Collection This chapter describes LogLogic s support for Microsoft Windows Server 2008/Windows Vista Operating System. LogLogic enables you to capture log data to monitor Microsoft Windows Server 2008 security related events. The chapter contains the following sections: Microsoft Windows Server 2008 s Overview Prerequisites Configuring Microsoft Windows Installing and Configuring Project Lasso Enabling the LogLogic Appliance to Capture Log Data Verifying the Configuration Microsoft Windows Server 2008 s Overview The LogLogic Appliance enables you to capture Microsoft Windows Server 2008 Audit, Authentication and other security related log data. Audit Logs Microsoft Windows Server 2008 provides options to system and user audit information such as audit policy change events, audit log cleared events, domain policy changed events, Object handle exception events and other similar events. These audit related events are captured and tracked; the changes made to critical system files can be used in regenerating the audit trials and to meet various compliance and regulatory requires. Authentication Logs Microsoft Windows Server 2008 events, in comparison to its earlier server OS, are hierarchical; the events are primarily organized based on the server roles and server fundaals. Within each role and fundaal, the information is organized in a hierarchical structure, based on the logical parts of an application or service that an administrator configures or uses to perform an administrative task. Windows user security and authentication related information such user account manage events, events related to security modifications to user groups, logon failures events and so on are captured in great detail. Microsoft Windows Server 2008 Log Configuration Guide 7

8 Prerequisites Prior to configuring Microsoft Windows Server 2008 and the LogLogic Appliance, ensure that you meet the following prerequisites: Microsoft Windows Server 2008 installed with proper access permissions to change the configuration files Microsoft Windows Server 2008 R2 Server German Note: Loglogic Universal Collector 2.2 or later is required for auto-detection of German Windows sources. See Adding Microsoft Windows Server Device on page 13 for manual configuration. User account with administrator privileges Third-party utility Snare/Lasso installed locally on Microsoft Windows Server 2008 or on a remote server that can be configured to listen to the security logs generated from source Operating System. For more information about the Project Lasso, see LogLogic Windows Collector Guide (Project Lasso). LogLogic Appliance running Release 5.1 or later installed with a Log Source Package that includes Microsoft Windows 2008 support Administrative access on the LogLogic Appliance Configuring Microsoft Windows Microsoft Windows operational events are posted in the Windows System logs, and can be viewed using Windows Viewer. These events are captured by the LogLogic Appliance using Project Lasso. Installing and Configuring Project Lasso Microsoft Windows logs are collected and transported to the LogLogic Appliance using Project Lasso. Project Lasso is used to collect and transfer Windows logs to the LogLogic Appliance. By default, the Project Lasso program directory is located at: C:\Program Files\Lasso Project Lasso spools log messages if the connection to the Appliance is temporarily lost. By default, the following directory contains all spooled log messages: C:\Program Files\Lasso\LassoRepository\Spool You can change the host machine and event log identification information by editing the hostlist.ini configuration file in Project Lasso. You can change the spool log location and other Lasso monitoring parameters by editing the Lasso.ini file. For the complete installation and configuration procedures for Project Lasso, including information on the Lasso.ini and hostlist.ini files, see the LogLogic Windows Collector Guide (Project Lasso). 8 Microsoft Windows Server 2008 Log Configuration Guide

9 Configuration of Lasso Enterprise To configure Lasso Enterprise: 1. Configure the IP address of Lasso Host as Windows event log collector to parse and forward the event logs to the LogLogic Appliance. The collector can be either local or remote to the event log source. Figure 1 Lasso Configuration: Add Target Host 2. The log source configuration is shown below. Figure 2 Lasso Configuration: Log Source Display 3. Configure the IP address and port (Syslog UDP port 514) of the LogLogic Appliance in the Lasso Enterprise console as shown below. Microsoft Windows Server 2008 Log Configuration Guide 9

10 Figure 3 Lasso Configuration: IP Adress and Port configuration 4. The syslog Lasso collector is automatically detected by the LogLogic Appliance. logs from the host are automatically parsed at the source and forwarded to the LogLogic Appliance. Configuration of Snare Collector To configure the Snare Collector: 1. Snare Windows event log collector collects and parses event logs from the source device, and forwards the logs to the LogLogic Appliance. Configure the IP address and port (Syslog UDP port 514) of the LogLogic Appliance in the Lasso Enterprise console as shown below. 10 Microsoft Windows Server 2008 Log Configuration Guide

11 Figure 4 Snare Collector Configuration: IP address and Port configuration 2. The syslog Snare collector is automatically detected by the LogLogic appliance. Once detected, event logs from the host are automatically forwarded to the LogLogic appliance. Snare Filtering Configuration Snare windows collector has an additional feature to filter out the events at the source. The filtering can be performed to maximize the WAN bandwidth especially when the events are collected from the remote collector. Figure 5 Snare Filtering Configuration Microsoft Windows Server 2008 Log Configuration Guide 11

12 The filtering parameters available in the Snare collector are as shown below. Figure 6 Snare Filtering Configuration - filtering parameters Enabling the LogLogic Appliance to Capture Log Data The following sections describe how to enable the LogLogic Appliance to capture Microsoft Windows log data. Configuring Auto Identification in the LogLogic Appliance With the auto-identification feature, the LogLogic Appliance recognizes Microsoft Windows log messages by default. As the log messages come into the Appliance, they are automatically identified and a new Microsoft Windows device type is added to the log source device list. Default values are used for certain properties, such as the device name. To enable auto-identification in the LogLogic Appliance: 1. Log in to the LogLogic Appliance. 2. From the navigation menu, select Administration > System Settings. The General tab appears. 3. For Auto-identify Log Sources select Yes. 4. Click Update. After enabling Auto-identification the Appliance will auto-identify the MS Windows device whenever logs are sent to the Appliance. 12 Microsoft Windows Server 2008 Log Configuration Guide

13 Once the automatically identified device is added, you can edit its properties. IMPORTANT! Do not change the auto-identified Device and Host IP information. To edit an existing Microsoft Windows Server device: 1. Log in to the LogLogic Appliance. 2. From the navigation menu, select > Devices. The Devices tab appears. 3. Click on an existing Microsoft Windows Server device in the list and click Modify Device. The Modify Device tab appears. Edit the device fields as needed, then click Update Device. Adding Microsoft Windows Server Device If you do not want to utilize the auto-identification feature, you can manually add a Microsoft Windows Server device to the LogLogic Appliance before you redirect the logs. IMPORTANT! LogLogic highly recommends using the auto-identification feature for all supported devices. If you want to add devices manually, make sure that the Auto-identify Log Sources setting is not enabled on the LogLogic Appliance. If the auto-identification setting is enabled and you manually add devices, duplicate device entries might appear on the Appliance. To add Microsoft Windows Server as a new device 1. Log in to the LogLogic Appliance. 2. From the navigation menu, select > Devices. The Devices tab appears. 3. Click Add New. The Add Device tab appears. Figure 7 Manually Adding a Device to the LogLogic Appliance Microsoft Windows Server 2008 Log Configuration Guide 13

14 Verifying the Configuration 4. in the following information for the device: Name Name for the Microsoft Windows Server device Description (optional) Description of the Microsoft Windows Server device Device Select Microsoft Windows from the drop-down menu Host IP IP address of the Microsoft Windows Server device Enable Data Collection Select the Yes radio button Refresh Device Name through DNS Lookups (optional) Select this checkbox to enable the Name field to be automatically updated. The name is obtained using a reverse DNS lookup on the configured refresh interval. The DNS name overrides any manual name you assign. 5. Click Add. 6. Verify that your new device appears in the Devices tab and that Enabled is set to Yes. When the logs arrive from the specified Microsoft Windows Server device, the LogLogic Appliance uses the device you just added if the hostname or IP match. The section describes how to verify that the configuration changes made to Microsoft Windows and the LogLogic Appliance are applied correctly. To verify the configuration: 1. Log in to the LogLogic Appliance. 2. From the navigation menu, select Dashboards > Log Source Status. The Log Source Status tab appears. 3. Locate the IP address for the Microsoft Windows device. If the device name (Microsoft Windows Server) appears in the list of devices (see Figure 8 on page 14), then the configuration is correct. Figure 8 Verification of the Microsoft Windows Configuration If the device does not appear in the Log Source Status tab, check the Microsoft Windows logs for events that should have been sent. If events were detected and are still not appearing on the LogLogic Appliance, verify the Microsoft Windows configuration, the Project Lasso configuration, and the LogLogic Appliance configuration. You can also verify that the LogLogic Appliance is properly capturing log data from Microsoft Windows by trying to view the data in the reports. LogLogic recommends checking the reports to make sure that the data obtained is valid and matches expectations. For more information, see LogLogic Real-Time on page 16. If the device name appears in the list of devices but event data for the device is not appearing within your reports, see Troubleshooting on page 17 for more information. 14 Microsoft Windows Server 2008 Log Configuration Guide

15 Chapter 2 How LogLogic Supports Microsoft Windows Server 2008 This chapter describes LogLogic's support for Microsoft Windows Server How LogLogic Captures Microsoft Windows Server 2008 Data LogLogic Real-Time LogLogic s open source Windows Collector Lasso or Snare can be used to collect Microsoft Windows Server 2008 security logs stored in the Windows Security log. The Security logs are further automatically forwarded to the LogLogic Appliance through Lasso /Snare syslog collectors. Project Lasso and Snare are the syslog collectors used to integrate Microsoft Windows Server 2008 with the LogLogic Appliance. The events from the Windows OS will get automatically colleted and parsed by these syslog collectors before and forwarded to Syslog listener of LogLogic Appliance. The LogLogic Appliance uses an automated mechanism to capture Microsoft Windows Server 2008 log messages via syslog using conventional UDP port 514. Log files since the last pull are automatically filtered out from collecting the next set of logs to eliminate duplication. Figure 9 illustrates the event flow diagram for the Windows events from its inception through to the LogLogic Appliance and to output in the form of reports and alerts. Figure 9 Flow from Microsoft Windows Through Project Lasso (or Snare) to the LogLogic Appliance The following example uses Windows 2008 server as the host device. Please note that the host device can be either local or remote to the Microsoft Windows 2008 Server. You must make sure to configure Lasso/Snare collectors with the IP address of the LogLogic Appliance in order for the LogLogic Appliance to capture the log messages from the host. How LogLogic Captures Microsoft Windows Server 2008 Data LogLogic's open source Windows Collector, Project Lasso, or Snare can be used to collect logs stored in the Windows Log. The Windows Collector is an open source application developed by LogLogic to collect and forward Windows event logs in syslog format to the LogLogic Appliance. Microsoft Windows Server 2008 Log Configuration Guide 15

16 If the Windows Collector is in Agent Mode, logs are collected and forwarded from the Windows system where it is installed. If the Windows Collector is in Collector Mode, logs are collected and forwarded from Windows systems other than the system where it is installed. The Windows Collector can also run in both modes at the same time. In hybrid mode, the Collector captures and forwards messages from the Windows machine where it is installed and from other Windows systems it is configured to access. Regardless of the mode used, all collected logs are converted into text format by the collector and then forwarded to the LogLogic Appliance s Syslog Listener via UDP or TCP. Once the data is captured and parsed, you can generate reports. In addition, you can create alerts to notify you of issues on Microsoft Windows. For more information on creating reports and alerts, see the LogLogic User Guide and LogLogic Online Help. LogLogic Real-Time LogLogic provides pre-configured Real-Time for Microsoft Windows log data. The following Real-Time are available: All Unparsed s Displays data for all events retrieved from the Microsoft Windows Server 2008 log for a specified time interval Permission Modification Displays events related to permission modifications performed on user and server objects User Access Displays data access and changes done to data during a specified time interval User Authentication Displays identity and access related events during a specified time interval User Created/Deleted Displays user creation and deletion events Displays user specific details and used to track user activity during a specified time interval Windows s Displays Windows event information served during a specified time interval To access LMI 5 Real-Time : 1. In the top navigation pane, click. 2. Click Access Control. The following Real-Time are available: Permission Modification User Access User Authentication User Created/Deleted Windows s 3. Click Operational. The following Real-Time are available: All Unparsed s You can create custom reports from the existing Real-Time Report templates. For more information, see the LogLogic User Guide and LogLogic Online Help. 16 Microsoft Windows Server 2008 Log Configuration Guide

17 Chapter 3 Troubleshooting and FAQ This chapter contains troubleshooting tips regarding the configuration and/or use of log collection for Microsoft Windows. It also contains an FAQ that provides quick answers to common questions. Troubleshooting Frequently Asked Questions Troubleshooting The logs are not showing in the reports: Check to see whether Microsoft Windows logging is configured; if not, configure it as per the instructions given in section Configuring Microsoft Windows. Frequently Asked Questions How does the LogLogic Appliance collect logs from Microsoft Windows? For log collection, a third-party utility Snare/Lasso is needed to read the.evt files from the Windows machine, convert them to text format, and forward them via syslog to the LogLogic Appliance. The LogLogic Appliance acts as the syslog server. What access permissions are required? To configure logging on Microsoft Windows, the Windows user must have administrative permissions. How do I configure logging on Microsoft Windows? Follow the procedures on Configuring Microsoft Windows on page 8. Also make sure that you have properly installed and configured Project Lasso. For more information, see Installing and Configuring Project Lasso on page 8 and the LogLogic Windows Collector Guide (Project Lasso). What steps are required if the LogLogic Appliance fails to collect security log events from Microsoft Windows Server 2008? 1. Make sure IP address of the intended LogLogic Appliance is configured in the Snare/ Lasso collectors. The default port used by these syslog collectors is UDP port Confirm that the collectors are automatically identified by the LogLogic Appliance. View Log Source Status in the Appliance dashboard. 3. Try restarting the Snare/Lasso Collector services in the agent server if collectors are unable to forward the logs to the LogLogic Appliance. Microsoft Windows Server 2008 Log Configuration Guide 17

18 18 Microsoft Windows Server 2008 Log Configuration Guide

19 Appendix A Reference This appendix lists the LogLogic-supported Microsoft Windows Server 2008 events. The LogLogic Microsoft Windows Server 2008 event table identifies events which can be analyzed through the LogLogic Agile, as well as a sample log message. All sample log messages were captured by LogLogic s Syslog listener. LogLogic Support for Microsoft Windows s The following list describes the contents of each of the columns in the tables below. Microsoft Windows Server 2008 event identifier Agile /Search Defines if the Microsoft Windows Server 2008 event is available through the LogLogic Agile Report Engine or through the search capabilities. If the event is available through the Agile Report Engine, then you can use LogLogic s Real-Time and Summary to analyze and display the captured log data. Otherwise, all other supported events that are captured by the LogLogic Appliance can be viewed by performing a search for the log data. Operating System Operating System (OS) where the event can be triggered. In some instances, duplicate s exist for different OSs. Title/Coms Description of the event of events such as System, Application, etc. of event such as Success audit, Failure audit, etc. Sample Microsoft Windows Server 2008 log messages captured by Snare/ Project Lasso Collectors. Microsoft Windows Server 2008 Log Configuration Guide 19

20 Table 1 Microsoft Windows Server 2008 s Item Coms Agile Win2008 The audit log was cleared. 1G Agile Windows German The audit log was cleared. Non Audit( Log) Non Audit( Log) Log Clear Log Clear / Windows s The audit log was cleared Security : WIN-R9H529RIO4Y\Administrator Name: Administrator Domain Name: WIN-R9H529RIO4Y Logon : 0x169e9 <1>May 25 14:04: MSWinLog 0 Security 0 Tue May Microsoft-Windows-log Unknown Information WIN-RL6247DIIT5.germanlab.w08.local Protokoll gelöscht Das Überwachungsprotokoll wurde gelöscht. Subjekt: Sicherheits-: S Kontoname: admin Domänenname: GERMANLAB Anmelde-: 0xd Agile Win2008 Windows NT is starting up. System Security State Windows is starting up. This event is logged when LSASS.EXE starts and the auditing subsystem is initialized. 2G Agile Windows German Windows NT is starting up. System Security State Windows s <1>May 25 13:29: MSWinLog 0 Security 0 Tue May Microsoft-Windows-Security-Auditing Unknown Success WIN-RL6247DIIT5.germanlab.w08.local Sicherheitsstatusänderung Windows wird gestartet. Dieses Ereignis wird protokolliert, wenn LSASS.EXE gestartet und das Überwachungssubsystem initialisiert wird Agile Win2008 Windows NT is shutting down. System Security State Windows NT is shutting down. Windows is shutting down. All logon sessions will be terminated by this shutdown Agile Win2008 Internal resources allocated for the queuing of audit messages have been exhausted, leading to the loss of some audits. System System Integrity Internal resources allocated for the queuing of audit messages have been exhausted, leading to the loss of some audits. Number of audit messages discarded: %1 This event is generated when audit queues are filled and events must be discarded. This most commonly occurs when security events are being generated faster than they are being written to disk, or when the auditing system loses connectivity to the event log, such as when the event log service is stopped. 20 Microsoft Windows Server 2008 Log Configuration Guide

21 Coms Agile Win2008 The system time was changed. System Security State <13>Aug 8 09:26: MSWinLog 0 Security 5298 Sat Aug 05 01:51: Security SYSTEM User Success Audit LOGLOGIC-SRV1 The system time was changed Security : ACME\administrator Name: administrator Domain: ACME Logon : 0x2f6de Process Information: Process : 0xf28 Name: C:\Windows\System32\rundll32.exe Previous Time: 8:23:53 AM 12/24/2007 New Time: 8:24:49 AM 12/24/2007 This event is generated when the system time is changed. It is normal for the Windows Time Service, which runs with System privilege, to change the system time on a regular basis. Other system time changes may be indicative of attempts to tamper with the computer G Agile Windows German The system time was changed. System Security State / Windows s <1>May 25 13:29: MSWinLog 0 Security 0 Tue May Microsoft-Windows-Security-Auditing Unknown Success WIN-RL6247DIIT5.germanlab.w08.local Sicherheitsstatusänderung Die Systemzeit wurde geändert. Antragsteller: Sicherheits-: S Kontoname: WIN-RL6247DIIT5$ Kontodomäne: GERMANLAB Anmelde-: 0x3e7 Prozessinformationen: Prozess-: 0x7c0 Name: C:\Program Files\VMware\VMware Tools\vmtoolsd.exe Vorherige Zeit:?2011?-?05?-?25T11:29: Z Neue Zeit:?2011?-?05?-?25T11:29: Z Dieses Ereignis wird generiert, wenn die Systemzeit geändert wird. Es ist normal, dass der mit Systemberechtigung ausgeführte Windows-Zeitdienst die Systemzeit regelmäßig ändert. Andere Änderungen der Systemzeit können darauf hinweisen, dass der Computer manipuliert wird Microsoft Windows Server 2008 Log Configuration Guide 21

22 Coms Agile Win2008 An account was successfully logged on. Logon / Logoff Logon User <13>Aug 8 09:26: MSWinLog 0 Authentication Security 5298 Sat Aug 05 01:51: Security / User Access SYSTEM User Success Audit LOGLOGIC-SRV1 / An account was successfully logged on Security : SYSTEM Name: WIN-R9H529RIO4Y$ Domain: WORKGROUP Logon : 0x3e7 Logon : 10 New Logon: Security : WIN-R9H529RIO4Y\Administrator Name: Administrator Domain: WIN-R9H529RIO4Y Logon : 0x19f4c Logon GU: { } Process Information: Process : 0x4c0 Process Name: C:\Windows\System32\winlogon.exe Network Information: Workstation Name: WIN-R9H529RIO4Y Source Network Address: Source Port: 1181 Detailed Authentication Information: Logon Process: User32 Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: Microsoft Windows Server 2008 Log Configuration Guide