Analysis and Evaluation of the Windows Event Log - Bill Buchanan

NAPIER UNIVERSITY
SCHOOL OF COMPUTING
PROJECT DIARY
Student: Barrie Codona
Supervisor: Bill Buchanan
Date: 20 th February 2008 Last diary date: 14 th December 2007
Objectives:
1. Begin writing the audit log software.
2. Separate the application into 3 separate agents, one for capturing the events, one for storing the
events and one for viewing the events.
Progress:
1. Initially an event driven Windows form was created using the dot net framework, it specifically
used the ‘file system watcher’ to monitor and report back any modifications that have been made to
any files on the local drive.
2. The first two agents are nearing completion, currently the capture agent is event driven and captures
any modifications that take place of the local file system and the user that caused these events, it
then formats this information into a string and generates an HMAC checksum which is tagged onto
the end of the string, using a TCP connection this is then sent to the logging agent. The logging
agent, which is also event driven, stamps the received message with its local date & time and writes
these events sequentially to a file.
Supervisor’s Comments:
Version 2
Napier University