Yes you could do it that way also. Would be the best for some instances. The reason I do it this way is that I only bring back the necessary fields from the log files and put the csv in a managers share for them to review. Some I have scheduled and auto emailed to some managers via cdosys. And I have written them with vbscript directly to web server so that they are available via intranet. I also parse multiple conditions in one pass and write data to more that one file at a time depending on the search criteria's involved. Maybe users logged data and looking for intrusion strings, urlscan, etc. at the same time or http requests to servers that people should not be requesting, thus logging to more than one file. It allows me to automate multiple criteria and receive notifications without my intervention unless I want to change the criteria. This script was the first that I did to simply bring back one users logged data at a time which is expandable very easily. I also use a similiar method for IIS and our web sites looking for hack strings to use like an early warning that is emailed to me daily. Not a realtime method but better than trying to read all of the log files.
Posts: 260
Joined: 7.Dec.2002
From: Romania
Status: offline
Hi learning
Have you forwarded your script to Jim for also posting it to isatools.org ? Would be nice to have it there as there's a whole bunch of useful scripts for ISA community ?
I would like to download it if you gonna make it available.
Posts: 271
Joined: 5.May2001
From: Redmond, WA
Status: offline
Are you guys aware that this is the whole reason for ISATools.org? If you create a kewl tool for ISA, send it to me and I'll post it to the site for all to download.
The only requirement I have is that you're willing to take direct support mail directly from the folks that use your tool.