Windows Security Auditing

https://technet.microsoft.com/en-us/library/79fe2474-6cdd-4411-8aee-20f9520ff3c8

Security Auditing

Updated: January 25, 2010
Applies To: Windows Server 2008, Windows Server 2008 R2
This navigation topic for the IT professional describes the documentation available to plan, implement, and monitor events by using features found in Windows Security Auditing.

Security auditing is one of the most powerful tools that you can use to maintain the security of your system. As part of your overall security strategy, you should determine the level of auditing that is appropriate for your environment. Auditing should identify attacks (successful or not) that pose a threat to your network, and attacks against resources that you have determined to be valuable in your risk assessment.

Note
Windows Security Auditing documentation has been republished to include additional versions of Windows. For updated information and links to current topics, see Security Auditing Overview.

Getting started

• Advanced Security Auditing Walkthrough
  
  This step-by-step guide uses Windows Server 2008 R2 and Windows 7 to demonstrate the process of setting up an advanced audit policies infrastructure in a test environment. During this process, you will create an Active Directory domain, install Windows Server 2008 R2 on a member server, install Windows 7 on a client computer, and configure two advanced audit policies.
  
• Advanced Security Auditing FAQ
  
  This topic lists common questions and their answers about understanding, deploying, and managing security audit policies.
  
• Which Editions of Windows Support Advanced Audit Policy Configuration
  
  This topic provides information about the versions of Windows that support advanced audit policy configuration, in addition to special considerations that apply to various tasks associated with auditing enhancements.
  

Deployment

• Planning and Deploying Advanced Security Audit Policies
  
  This topic explains the options that security policy planners must consider and the tasks they must complete to deploy an effective security audit policy in a network. Advanced security audit policies were introduced in Windows 7 and Windows Server 2008 R2, but they also apply to other versions. This topic also lists the supported versions.
  

Technical reference

• Security Audit Policy Reference
  
  This topic provides information about the auditing settings available in Windows Server 2008 R2 and Windows 7 and the audit events that they generate.
  
  For information about the Advanced Security Policy settings that are included in other versions of Windows, see Advanced Security Audit Policy Settings.
  

Installed Help

• Auditpol
  
  This topic provides syntax and examples for using the Auditpol command-line tool. Auditpol can be used to display information about audit policies and to perform functions to manipulate them.
  

Additional resources

• Security Audit Events for Windows 7 and Windows Server 2008 R2
  
  
• Security audit events for Windows Server 2008 and Windows Vista
  
  
• AD DS: Auditing
  
  This topic describes new auditing capabilities in Active Directory Domain Services (AD DS).
  
• AD DS Auditing Step-by-Step Guide
  
  This topic shows how to log old and new values when changes are made to Active Directory objects and their attributes.
  
• Security Monitoring and Attack Detection Planning Guide
  
  This guide describes how to plan a security monitoring system in Windows-based networks.
  
• How to use Group Policy to configure detailed security auditing settings for Windows Vista-based and Windows Server 2008-based computers in a Windows Server 2008 domain, in a Windows Server 2003 domain, or in a Windows 2000 domain
  
  In Windows Vista and Windows Server 2008, you can manage audit policies at a more detailed level by using audit policy subcategories. This topic describes a procedure that administrators can use to deploy a custom audit policy that applies detailed security auditing settings for computers that are running Windows Vista or Windows Server 2008.

How to add Google Analytics to Joomla

Today we're going to answer a very straight forward question that we have been asked: "How can I add Google Analytics to Joomla?"

Google Analytics is a free website tracking tool which helps you understand your website's visitor. We highly recommend it, and in this post will run you through how to add Google Analytics to either Joomla 1.5 or Joomla 1.0.1x.

We have broken down the answer of this question into two steps:

1. Create a Google Analytics account
2. Add the Analytics code to your Joomla template(原來要加在template裡的index.php)

Read more: How to add Google Analytics to Joomla http://www.goodwebpractices.com/joomla/add-google-analytics-to-joomla.html#ixzz2YdZAgP8V

常用的主机监控shell脚本

作者：Mike.Xu 发表于: October 15, 2009 10:10 PM
转载时请务必以超链接形式标明文章 原始出处和作者信息及本版权声明。
链接：http://www.dbasky.net/archives/2009/10/shell.html

       有一段时间没更新Blog了主要是时间有点紧张。然而最近时不时有互联网的朋友问我关于服务器监控方面的问题？问常用的服务器监控除了用开源软件，比如：cacti，nagios监控外是否可以自己写shell脚本呢？根据自己的需求写出的shell脚本更能满足需求，更能细化主机监控的全面性。
      下面是我常用的几个主机监控的脚本，大家可以根据自己的情况在进行修改，希望能给大家一点帮助。
 1、查看主机网卡流量

#!/bin/bash

#network

#Mike.Xu

while : ; do

      time='date +%m"-"%d" "%k":"%M'

      day='date +%m"-"%d'

      rx_before='ifconfig eth0|sed -n "8"p|awk '{print $2}'|cut -c7-'

      tx_before='ifconfig eth0|sed -n "8"p|awk '{print $6}'|cut -c7-'

      sleep 2

      rx_after='ifconfig eth0|sed -n "8"p|awk '{print $2}'|cut -c7-'

      tx_after='ifconfig eth0|sed -n "8"p|awk '{print $6}'|cut -c7-'

      rx_result=$[(rx_after-rx_before)/256]

      tx_result=$[(tx_after-tx_before)/256]

      echo "$time Now_In_Speed: "$rx_result"kbps Now_OUt_Speed: "$tx_result"kbps"

      sleep 2

done

2、系统状况监控

#!/bin/sh

#systemstat.sh

#Mike.Xu

IP=192.168.1.227

top -n 2| grep "Cpu" >>./temp/cpu.txt

free -m | grep "Mem" >> ./temp/mem.txt

df -k | grep "sda1" >> ./temp/drive_sda1.txt

#df -k | grep sda2 >> ./temp/drive_sda2.txt

df -k | grep "/mnt/storage_0" >> ./temp/mnt_storage_0.txt

df -k | grep "/mnt/storage_pic" >> ./temp/mnt_storage_pic.txt

time=`date +%m"."%d" "%k":"%M`

connect=`netstat -na | grep "219.238.148.30:80" | wc -l`

echo "$time  $connect" >> ./temp/connect_count.txt

 

3、监控主机的磁盘空间,当使用空间超过90％就通过发mail来发警告

#!/bin/bash

#monitor available disk space

SPACE='df | sed -n '/ \ / $ / p' | gawk '{print $5}' | sed  's/%//'

if [ $SPACE -ge 90 ]

then

fty89@163.com

fi

4、 监控CPU和内存的使用情况

#!/bin/bash

#script  to capture system statistics

OUTFILE=/home/xu/capstats.csv

DATE='date +%m/%d/%Y'

TIME='date +%k:%m:%s'

TIMEOUT='uptime'

VMOUT='vmstat 1 2'

 USERS='echo $TIMEOUT | gawk '{print $4}' '

LOAD='echo $TIMEOUT | gawk '{print $9}' | sed "s/,//' '

FREE='echo $VMOUT | sed -n '/[0-9]/p' | sed -n '2p' | gawk '{print $4} ' '

IDLE='echo  $VMOUT | sed -n '/[0-9]/p' | sed -n '2p' |gawk '{print $15}' '

echo "$DATE,$TIME,$USERS,$LOAD,$FREE,$IDLE" >> $OUTFILE

5、全方位监控主机

#!/bin/bash

# check_xu.sh

# 0 * * * * /home/check_xu.sh

DAT="`date +%Y%m%d`"

HOUR="`date +%H`"

DIR="/home/oslog/host_${DAT}/${HOUR}"

DELAY=60

COUNT=60

# whether the responsible directory exist

if ! test -d ${DIR}

then

        /bin/mkdir -p ${DIR}

fi

# general check

export TERM=linux

/usr/bin/top -b -d ${DELAY} -n ${COUNT} > ${DIR}/top_${DAT}.log 2>&1 &

# cpu check

/usr/bin/sar -u ${DELAY} ${COUNT} > ${DIR}/cpu_${DAT}.log 2>&1 &

#/usr/bin/mpstat -P 0 ${DELAY} ${COUNT} > ${DIR}/cpu_0_${DAT}.log 2>&1 &

#/usr/bin/mpstat -P 1 ${DELAY} ${COUNT} > ${DIR}/cpu_1_${DAT}.log 2>&1 &

# memory check

/usr/bin/vmstat ${DELAY} ${COUNT} > ${DIR}/vmstat_${DAT}.log 2>&1 &

# I/O check

/usr/bin/iostat ${DELAY} ${COUNT} > ${DIR}/iostat_${DAT}.log 2>&1 &

# network check

/usr/bin/sar -n DEV ${DELAY} ${COUNT} > ${DIR}/net_${DAT}.log 2>&1 &

#/usr/bin/sar -n EDEV ${DELAY} ${COUNT} > ${DIR}/net_edev_${DAT}.log 2>&1 &

   放在crontab里每小时自动执行：

0 * * * * /home/check_xu.sh

   这样会在/home/oslog/host_yyyymmdd/hh目录下生成各小时cpu、内存、网络，IO的统计数据。

   如果某个时间段产生问题了，就可以去看对应的日志信息，看看当时的主机性能如何