Analysis and Evaluation of the Windows Event Log - Bill Buchanan

Barrie Codona, BSc (Hons) Network Computing, 2007
For this test a simple application will be created and installed as a service on a
Microsoft Server 2003 environment, this will be used to call the Client application. It
will be run under VMWare with a second Server 2003 that will act as the log server.
A Microsoft Windows XP client will be used to generate the traffic of files being
modified via the use of a mapped drive to the File Server.
Figure 61: Custom event log showing ‘SecEvent.Evt’
As it can be seen from the above screenshot, the application successfully managed to
monitor the windows event log folder and the shared data folder. It was noted that the
application was not properly capturing the username that caused the event, it was
however, capturing the username of the user that was currently logged onto the server,
in this case the administrator.
6.8 Conclusions
Based upon the testing that was carried out it was initially noted that the use of
asynchronous encryption, to encode a large number of events, caused a serious drain
on the system. When both the synchronous and asynchronous encryption techniques
were compared to each other it was found that the synchronous encryption was 800%
faster than the asynchronous one. These results lead to the modification of the
application to make use of asynchronous encryption only for exchanging the
synchronous shared key.
The accuracy of the application was measured by generating a large number of events
on the system, when using synchronous encryption it handled them with ease. Before
66