# Presentation: 205163

## PC Manager Meeting

- January 25, 2006

## Today

- Updates
- Next Meeting
- Meeting Maker Upgrade
- Windows Policy
- Training
- Licensing
- Security
- Tool Of The Month
- This Month:
-  Event Sentry: CSI Server Logging
- Ken Fidler

## Next Meeting

- Feb.  22nd
- Topic TBD!

## Meeting Maker Upgrade 

- Upgraded server from 8.5.1 to 8.5.3 (performance improvements)
- Some clients at 8.5.1 experiencing problems
- New Clients available
- SMS package available
- New code on website
- http://www-css.fnal.gov/csi/meetingmaker/Documentation.htm

## Windows Policy Committee

- Next Meeting:
- Feb 1st, 1:30-2:30pm, WH5SW
- Agenda:
- Outstanding Account Requests
- Server and Desktop Baseline Review

## Training and Development

- Nicole Gee:
- Learning Tree Discounts
- NIU BIS
- Python programming classes scheduled for Feb. and April
- Is there interest for EPICS,Perl, Java, and Javascript training?

## License Updates

- Request from Microsoft to Patch:
- Background: It was recently decided in a court of law that certain portions of code found in Microsoft Office Professional Edition 2003, Microsoft Office Access 2003, Microsoft Office XP Professional and Microsoft Access 2002 infringe a third-party patent. As a result, Microsoft must make available a revised version of these products with the allegedly infringing code replaced.
- Action required: As a result of the above ruling, you are required to:
- Install Microsoft Office 2003 Service Pack 2 (Office 2003 SP2) for all your future deployments of Office Professional Edition 2003 and Office Access 2003
- Install the Microsoft Office XP Service Pack 3 Patch (Office XP SP3 Patch) for all your future deployments of Office XP Professional and Access 2002
- No required date given. CSS will provide an SMS package!

## Security Updates

- Jan 2006, Fermi Windows Base Install CD Highlights
- Sav 10.0.2 and Sav 10.0.2.2001 patch
- Latest Microsoft patches
- JoinDomain script
- SMS Agent auto installed by GPO imediately after PC joins domain
- ISO Image in _[\\](file://pseekits/iso$/FermiWin)__[pseekits\iso$\FermiWin](file://pseekits/iso$/FermiWin)_
- Free CDs!
- The future ... SMS "Package Bundles" to complete the setup process
- Minimal_Desktop_Bundle (Add AcroReader, .NET, MediaPlayer, MtgMkr ....etc)
- General_Desktop_Bundle (Minimal_Desktop + Office Pro + ... etc)

## Cool Tool of The Month

- Shortcutsman
- _[http://www.nirsoft.net/utils/shman.html](http://www.nirsoft.net/utils/shman.html)_
- Displays details of shortcuts on desktop and start menu
- Highlights broken shortcuts
- Ability to delete/resolve
- Save shortcut info to HTML/Text/XML file
- Small executable
- Need admin rights for delete/resolve/reporting

## Cool Tool of The Month (cont)

## Main Topic

- Event Sentry: CSI Server Logging
- Ken Fidler

## EventSentry - What is it?

-  Near real-time monitoring of Windows event logs
- Servers/Kiosks/remote systems
-  System Health Monitor
- Disk Space
- Processes
- Services
-  Syslog Client/Server for Windows
-  Temperature and Humidity Monitor

## EventSentry – Why Use it?

- Timely analysis of event data
- Alert admins before there is a serious problem
- Archive event data for future analysis
- Detect intrusions

## EventSentry – Special Features

- Export/Import filter sets to additional systems
- Multiple Notification avenues
- E-mail
- Program
- Syslog service
- Write to a file or a database
- Monitor when you DO NOT receive key event log messages
- No reboot after install or upgrades
- Low cost

## EventSentry – Usage in CSI

- Monitor server events
- Warn team of disk RAID or hardware failures
- Used on test domain controllers
- Monitor Active Directory
- Central windows syslog server
- On Central AV server to enhance alerts and logging info from Symantec software

## EventSentry – Main Screen

## EventSentry - DEMO

## EventSentry – Define Notification

## EventSentry - Variables

**Runtime variables** (just a subset)
- $HOSTNAME local computer name
- $COUNT
- 	the number of event log records in the email
- $EVENTTYPE
- 	the event type of the first event
- $FILTER the name of the filter which captured the event

## EventSentry – User Variables

## EventSentry – Define Filters

## EventSentry – Email Output

## EventSentry – Save to a file

## EventSentry – Default Notification

## EventSentry – Default Filter

## EventSentry – Client Syslog

## EventSentry – Client Syslog

## EventSentry – Syslog Server

## EventSentry – Syslog Server

## EventSentry – Syslog Server

## EventSentry - Syslog

- Server code is only UDP based.
- Server will accept most Unix systems too
- Client – verification to UDP based servers does not return any errors

## EventSentry – Call a Program

## EventSentry – Call a Program

## EventSentry – Monitor Services

## EventSentry – Monitor Disk Space

## EventSentry – Monitor Temp

## EventSentry – Monitor Temp

- Requires special hardware from Netikus
- Temp sensory - $80
- Temp and Humidity - $140

## EventSentry – CSI Futures

- Interface to Remedy and NGOP
- Central Controls
- Setup Server Groups
- Alerts to Application support groups
- Use Active Directory
- Web Interface
- Syslog to a database
- Tools to extract data from syslog files

## EventSentry

- Miscellaneous Comments/Observations
- Central control – Plan a strategy
- Low overhead – Lean C++ code
- Heartbeat monitor - NGOP
- Monitor disk activity – Trend changes
- Small company – Very good support

## EventSentry

- Initial Cost ~$45/machine
- FREE Trial version available
- Maintenance:  ~18%
- More info?
- _[www.netikus.com](http://www.netikus.com/)_
- FREE Tools on their site
- Windows Security Log Reference Sheet
- www.ultimatewindowssecurity.com