Analysis and Evaluation of the Windows Event Log - Bill Buchanan

Barrie Codona, BSc (Hons) Network Computing, 2007
by the data archiving system, and also by the event viewer when reading the contents
of the event log.
Unfortunately due to time constraints, these components of the application were not as
fully developed was they could have been. The original design of the Data Archiving
System specification was to allow for both of the Event Logging Application and
Event Viewer Application to be able to remotely access the event log that was stored
on the Server, unfortunately there is no support within the Server Application to allow
for a remote connection to the Server, it will however run on the Server without any
problems.
It had been originally planed that the encryption between the Client and Server could
also be done using synchronous encryption with the secret key being exchanged using
asynchronous encryption. The communications that both the Client and Server use is
only asynchronous encryption; this will obviously cause problems with the
performance.
Also, the Server does not run in a finite state, that is after a Client has terminated its
connection to the Server, the Server application will shutdown. It could have been
written so that the Server returns back to its original listening state.
Another unachieved goal of the Event Viewer Application was for it to be able to
display a list of all the events that have happened and for it to allow the user to be able
to browse for a specific event.
Apart from these minor short comings the overall concept of having an Event Logger
that securely stores its Event Logs off site using a remote connection has been
achieved. If time permits a maintenance phase could be used to try and address some
of these issues.
50