An Event Viewer listing. You can obtain additional information about various events displayed in the Event Viewer by selecting an event and double-clicking on it. The dialog box in Figure 8.7 is invoked by double-clicking on the event selected in Figure 8.6. Detailed information about an event displayed in the Event Viewer. If you detect suspicious activity, monitoring access log files is a good idea.
Log files can easily be several megabytes is size.
Manually going over access log files, therefore, is not a very good idea. If you detect repeated suspicious activity, however, you can use the access log file to obtain additional information. If several messages appear in the Event Log, similar to the one shown in Figure 8.7, for example, you can use the access log file to obtain additional information such as the IP address of the user who tried to access the system. Figure 8.8 demonstrates how the access log file can be used to obtain detailed information about the event in Figure 8.7. In this example, the time and date of the event in Figure 8.7 are used as an index to locate the corresponding access log file entry.