The security log will be of most interest to administrators that want to audit users access patterns. The security log can contain valid and invalid logon attempts as well as events related to resource use, such as creating, opening, or deleting files or other objects. For example, if you use User Manager for Domains to enable logon and logoff auditing, attempts to log on to the system are recorded in the security log. The application log contains events logged by applications. For example, a database program might record a file error in the application log.
Application developers decide which events to monitor.
The system log contains events logged by the Windows NT Server system components. For example, the failure of a driver or other system component to load during startup is recorded in the system log. Enabling Security Logging By default, security logging is turned off. To enable security logging, run User Manager for Domains to set the Audit policy. For the security log, the administrator can also set auditing policies in the registry that cause the system to halt when the security log is full.