Copyright: DumpEvt Copyright ® 1995 Somar Software


DumpEvt Help Contents
Somar™ DumpEvt™ Version 1.1 Help Contents

Copyright © 1994-1995 Somar Software

Send problem reports and comments to 72202.2574@compuserve.com

For information about other Somar products, visit the Somar Software Web site at http://www.somar.com.

Overview

Installation

Uninstallation

Command line options

Known bugs, limitations and planned enhancements

SQL Server script

Access definitions

Copyright/License/Warranty Disclaimer

Registration


Overview of DumpEvt
Overview

Somar DumpEvt is a program for Windows NT that will dump the eventlog in a format suitable for importing into a database. DumpEvt is similar to DUMPEL utility in the NT resource kit, but fixes various defects of that program that make it unsuitable for producing output suitable for importing into an Access or SQL server database.

Typically, Somar DumpEvt is used as part of a batch file similar to the following:

dumpevt /computer=server1 /logfile=sec /outdir=c:\dumpevt\ >>c:\dumpevt\errors.txt

dumpevt /computer=server2 /logfile=sec /outdir=c:\dumpevt\ >>c:\dumpevt\errors.txt

dumpevt /computer=server3 /logfile=sec /outdir=c:\dumpevt\ >>c:\dumpevt\errors.txt

This batch file would be scheduled to run each night (using the AT command). It would dump the security event logs for the 3 servers to a new file created in the c:\dumpevt directory. Each morning, or on an as-needed basis, the network administrator would import all new files in this directory into an Access or SQL Server or other database, so that analysis could be performed on the history of logins, file access violations, etc. Eventually, this log information could be archived.

Advantages of Somar DumpEvt, as compared with the DUMPEL utility

1) The DumpEvt output can be tab separated or comma separated columns. In both cases, control characters in the event log data (such as line feeds, carriage returns, tabs) are converted to blanks. For the comma separated format, commas in the event log data are also converted to blanks (to avoid this additional conversion, tab separated is normally preferable). The DUMPEL utility does not do this conversion and so the output contains extra linefeeds and carriage returns which cause errors in the Access and SQL Server import tools.

2) Event log data is truncated so that there should never be a failure during Access or SQL Server import. In particular, the data will be truncated so no field exceeds 255 chars (max width of an Access Text or SQL Server varchar field) and the total record length will be less than the SQL Server max of 1962. Whenver the truncation is performed, an error message is logged to stdout. DUMPEL does not ensure that all fields are less than 255 chars and this causes errors with the Access and SQL server import tools.

3) Only log records added since the last execution of DumpEvt are dumped. The record number of the last log record dumped is automatically kept in the DumpEvt registry entry (with a separate key for each computer). This makes it easy to accumulate all log records with no duplicates. You can override this feature and request to dump all event log records, using the /all parameter. The DUMPEL utility has no such feature, and so makes it difficult to avoid accumulating duplicate log messages in the Access or SQL Server database.

4) You can specify the format of the timestamp in the dump output. This is useful if your database import program does not accept standard date formats. The DUMPEL utility always uses the same date format, which may not be acceptable for your database.

5) Up to 20 event log data strings are dumped (these data strings are what is supplied by the logging application and are normally used as parameters for a template contained in a message table). Extra tabs or commas are inserted in the DumpEvt output so that there will always be exactly 20 strings. The DUMPEL utility only dumps the number of data strings which are available. This number may vary for different event log records, which causes errors with the Access and SQL server import tools.


Installation

1) Place DUMPEVT.EXE and DUMPEVT.HLP together in any directory.

2) Whenever DUMPEVT.EXE is run, it will create and/or update the following registry key:

HKEY_LOCAL_MACHINE\SOFTWARE\SomarSoftware\DumpEvt

3) Somar DumpEvt makes no other changes to your system.


Uninstallation

1) Run DUMPEVT.EXE with /u as a command line parameter. If successful, a message will be printed to the console indicating that the SomarSoftware\DumpEvt registry key has been deleted.

2) Delete DUMPEVT.EXE and DUMPEVT.HLP from your computer.


Command Line Options

Note: all options are case sensitive.

Note: status and error messages written to stdout.

Required parameters

/logfile=file	3 char logfile to dump abbreviation (app=Application, sys=System, sec=Security)
(exactly one of the following options is required)

/outfile=drive:\path	File will be created if it doesn't exist, else new output will be appended to existing file.
/outdir=drive:\path	Directory in which to create output file. File name will be like DVT???.tmp, where ??? is a hexadecimal number.
Optional parameters:

/computer=computer	Computer for which to dump information. Default is to dump local information.
/date=format	Fomat in which to dump date part of timestamp. Default is standard system locale dependent date format. Format value is whatever is acceptable to GetDateFormat system API. Normally need to enclose format value in double quotes. Examples:
/date="yy/MM/dd"	produces date like 95/01/31
/date="dd MMM yyy"	produces date like 31 Jan 1995
/all	Dump all event log records. Default is only to dump log records added since last time DumpEvt was run. The record number of the last log record dumped by DumpEvt is stored in the registry. There is a separate registry entry per computer.
/csv	Dump in comma separated format. Default is to dump in tab separated format. For both formats, all control characters (line feeds, carriage returns, etc) in the event log data are converted to blanks. For the comma separated format, commas are also converted to blanks (to avoid this additional conversion, tab separated is normally preferable).
/?	Display abbreviated help information to stdout.

Examples:

dumpevt.exe /computer=server1 /logfile=sec /outfile=c:\dumpevt\dumpevt.out /csv

Dump records in security event log on server1. Dump only records that have been added since last time Somar DumpEvt was run. Append formatted dump output to c:\dumpevt\dumpevt.out in comma separated format, creating this file if it didn't already exist. Print status and error messages to current console. Use standard locale dependent date format. Update registry with record number of last log record dumped.

dumpevt.exe /logfile=sec /outdir=c:\dumpevt\ /all /date="yyy/mm/dd" >> c:\errors.txt

Dump all records in security event log on local computer. Write formatted dump output, in tab separated format, to new file with name like DVT???.tmp in directory c:\dumpevt. Append status and error messages to c:\errors.txt. Format dates in dump like 1995/01/31. Update registry with record number of last log record dumped.

dumpevt.exe /?

Display help information to stdout.


Known bugs and limitations
Known bugs, limitations and planned enhancements

1) Depending on customer demand, a program to automate the copying of the DumpEvt output into a database, using ODBC, may be written. My experience has been that this is more trouble than relying on a human to do the importing on an as-needed basis. In particular, there is the issue of correctly handling the case of running out of room in the database. However, my experience may not be representative of all situations.

2) Many log records include an account, specified as a SID. If the conversion of SID to readable domain/account fails, the SID is simply converted to readable character SID format (e.g. S-1-5-3-19893).

3) DumpEvt dumps only the raw event log data. Another option would be to dump the formatted log records. This would greatly increase the size of the resulting output, however. My experience has been that it is possible to obtain the information I want (logins, etc) by simply comparing the formatted output in Event Viewer with the output to DumpEvt, to determine which event log data string contains the significant information.

4) If you are running DumpEvt using the AT command to dump security event log information from remote computers, the AT command should be running under an administrator account and not the LocalSystem account. The LocalSystem account does not normally have the authorization to dump security event log information for remote computers.


Access definitions

The following are the Access definitions for Events and Descriptions tables. The event log output produced by DumpEvt can be imported into the Events table, using the Access import tool. In the import dialog, be sure to specify the appropriate delimiter (tabs or commas).  The data in the Descriptions table is typically entered manually by the network administrator, and contains descriptions of whatever event log messages the administrator considers important. The Descriptions table can then be joined with the Events table to produce a readable report.

Events Table (no primary index)

Field	DateType	FieldSize	Required
LogFile	Text	3	Yes
TimeWritten	Date/Time		Yes
Source	Text	100	Yes
EventID	Number	Long integer	Yes
EventType	Number	Integer	Yes
Category	Number	Integer	Yes
User	Text	64	No
Computer	Text	64	No
String0	Text	255	No
String1	Text	255	No
String2	Text	255	No
String3	Text	255	No
String4	Text	64	No
String5	Text	64	No
String6	Text	64	No
String7	Text	64	No
String8	Text	64	No
String9	Text	64	No
String10	Text	32	No
String11	Text	32	No
String12	Text	32	No
String13	Text	32	No
String14	Text	32	No
String15	Text	32	No
String16	Text	32	No
String17	Text	32	No
String18	Text	32	No
String19	Text	32	No
Descriptions Table (primary index on Source and EventID fields)

Field	DateType	FieldSize	Required
Source	Text	100	Yes
EventID	Number	Long integer	Yes
Description	Text	255	Yes


SQL Server script
SQL Server creation script

The following script will create Events and Descriptions tables (assuming the dumpevt database has already been created). The event log output produced by DumpEvt can be imported into the Events table, using bcp. The data in the Descriptions table is typically entered manually by the network administrator, and contains descriptions of whatever event log messages the administrator considers important. The Descriptions table can then be joined with the Events table to produce a readable report.

USE dumpevt

GO

CREATE TABLE Events (

   LogFile      char(3),

   TimeWritten  datetime,

   Source       varchar(100),

   EventID      int,

   EventType    smallint,

   Category     smallint,

   User         varchar(64)  NULL,

   Computer     varchar(64)  NULL,

   String0      varchar(255) NULL,

   String1      varchar(255) NULL,

   String2      varchar(255) NULL,

   String3      varchar(255) NULL,

   String4      varchar(64)  NULL,

   String5      varchar(64)  NULL,

   String6      varchar(64)  NULL,

   String7      varchar(64)  NULL,

   String8      varchar(64)  NULL,

   String9      varchar(64)  NULL,

   String10     varchar(32)  NULL,

   String11     varchar(32)  NULL,

   String12     varchar(32)  NULL,

   String13     varchar(32)  NULL,

   String14     varchar(32)  NULL,

   String15     varchar(32)  NULL,

   String16     varchar(32)  NULL,

   String17     varchar(32)  NULL,

   String18     varchar(32)  NULL,

   String19     varchar(32)  NULL)

GO

CREATE TABLE Descriptions (

   Source       varchar(100),

   EventID      int,

   Description  varchar(255))

GO

CREATE UNIQUE CLUSTERED INDEX DescriptionsIndex ON Descriptions

   (Source, EventID)

GO


Copyright/license/warranty
Copyright/License/Warranty Disclaimer

Somar DumpEvt is Copyright © 1994-1995 Somar Software, All rights reserved.

Send problem reports and other comments to 72202.2574@compuserve.com.

License Agreement and Warranty Disclaimer

You should carefully read the following terms and conditions before using this software.  Use of this software indicates your acceptance of these terms and conditions.  If you do not agree with them, do not use the software.

Shareware Version

You are hereby licensed to: use the Shareware Version of the software for a 21 day evaluation period; make as many copies of the Shareware version of this software and documentation as you wish; give exact copies of the original Shareware version to anyone; and distribute the Shareware version of the software and documentation in its unmodified form via electronic means. There is no charge for any of the above.

You are specifically prohibited from charging, or requesting donations, for any such copies, however made; and from distributing the software and/or documentation with other products (commercial or otherwise) without prior written permission, with one exception: Disk Vendors approved by the Association of Shareware Professionals are permitted to redistribute Somar DumpEvt, subject to the conditions in this license, without specific written permission.

You are specifically prohibited from copying or redistributing the keyfile (DUMPEVT.KEY) that will be sent to you upon receipt of your registration payment.

Unregistered use of Somar DumpEvt after the 21-day evaluation period is in violation of United States and International copyright laws.

For how to register, see Registration.

A single registered copy of Somar DumpEvt can only be installed on a single computer. Thus, if you have 3 computers on which you want to install Somar DumpEvt, you must register and pay for 3 copies of Somar DumpEvt. You may access the registered version of Somar DumpEvt through a network, provided you have obtained individual licenses for the sotware covering all workstations that will access the software through the network. There is no license required for dumping information for remote servers. Thus, if you have 100 servers divided into 3 domains and you have installed and run DUMPEVT.EXE only on the 3 primary domain controllers, with information pulled over the network from the event logs of backup domain controllers using the /computer= option, then you need 3 licenses, not 100.

Governing Law

This agreement shall be governed by the laws of the District of Columbia.

Disclaimer of Warranty

THIS SOFTWARE AND THE ACCOMPANYING FILES ARE SOLD "AS IS" AND WITHOUT WARRANTIES AS TO PERFORMANCE OF MERCHANTABILITY OR ANY OTHER WARRANTIES WHETHER EXPRESSED OR IMPLIED. BECAUSE OF THE VARYING HARDWARE/SOFTWARE ENVIRONMENTS INTO WHICH SOMAR DUMPEVT MAY BE PUT, THERE IS NO WARRANTY OF FITNESS FOR A PARTICULAR PURPOSE.

GOOD DATA PROCESSING PROCEDURE DICTATES THAT ANY PROGRAM BE THOROUGHLY TESTED BEFORE RELYING ON IT. THE USER MUST ASSUME THE ENTIRE RISK OF USING THE PROGRAM. ANY LIABILITY OF THE SELLER WILL BE LIMITED EXCLUSIVELY TO PRODUCT REPLACEMENT OR REFUND OF PURCHASE PRICE.


Registration

This is not free software. This license allows you to use this software for evaluation purposes without charge for a period of 21 days.  If you use this software after the 21 day evaluation period a registration fee of $10 is required. Payments must be in US dollars drawn on a US bank,  payable to Somar Software, and sent to:

Somar Software

1 Scott Circle, NW Suite 816

Washington, DC 20036

USA

You can also register through CompuServe (GO SWREG, ID 5999).

Upon receipt of your registration payment (check or CompuServe notice), you will be sent a key file (DUMPEVT.KEY), which is to be placed in the same directory as DUMPEVT.EXE. This key file will be your proof of registration and will cause the "unregistered" warning to be replaced by your registration name and number.

Somar Software reserves the right to increase the registration fee at any time without notice. If the fee has been increased, and your payment is received after such increase, then Somar Software has the right to require additional payment before accepting your registration and sending you a key file. Once you have paid the then current registration fee, and Somar Software has accepted your fee and sent you a key file, you have the right to use the version of Somar DumpEvt that you paid for, for as long as you want, without additional payment. Future versions of Somar DumpEvt may require a different key file. You may be required to pay an additional fee to upgrade to such future versions.

A single registered copy of Somar DumpEvt can only be installed on a single computer. Thus, if you have 3 computers on which you want to install Somar DumpEvt, you must register and pay for 3 copies of Somar DumpEvt. You may access the registered version of Somar DumpEvt through a network, provided you have obtained individual licenses for the sotware covering all workstations that will access the software through the network. There is no license required for dumping information for remote servers. Thus, if you have 100 servers divided into 3 domains and you have installed and run DUMPEVT.EXE only on the 3 primary domain controllers, with information pulled over the network from the event logs of backup domain controllers using the /computer= option, then you need 3 licenses, not 100.