CHAPTER 9
Managing Logs
WHAT YOU WILL LEARN IN THIS CHAPTER:
- Windows Event Viewer
- PowerShell
- BareTail
- Syslog
- Solarwinds Kiwi
When I was growing up, my older brother was a Trekkie, a Star Trek fan. James T. Kirk, the captain of the U.S.S. Enterprise, would make entries into a captain's log. The captain's log has been a form of record keeping since the first captains sailed the seas. The log was used to inform the captain's superiors, either owners of the ship or governmental entities, what was happening while exploring or completing a mission or to record historical facts for future generations. Our networks work the same way. Every device on your network generates some type of log‐in some type of language. Some of it is human readable, and some looks like gibberish. Some logs are more useful than others, and we should understand which ones need to be preserved for future analysis. You don't need to log everything, but what you do log should be purposely collected...
