Anyone know of any good software usage logging software?

[ninjabeaver]

Hi everyone,

 

After we have been OFSTED'ed I'm looking at re-doing the school image and getting rid of WinSuite.

 

The problem is WinSuite has a great facility of logging all the usage on the PC's by students and staff, and has come into it's own today for tracking down some students defacing photographs and causing offense to staff and the pupils whose pictures where used.

 

Now, I would like to find some free software that can do the same, but idealy something that can store more information. Not necessarily down to keystroke level, but log every file and program opened accessed etc.

 

Can anyone possibly help.

 

Many thanks again,

 

Simon

-NinjaBeaver

[Ric_]

@ninjabeaver: You may be able to achieve something like this by turning up the amount of auditing that Windows does. You will end up with HUGE event logs though.

[Geoff]

To deal with the huge event logs, look at Snare Eventlog Agent.

 

http://www.intersectalliance.com/projects/SnareWindows/

[tarquel]

nice nice nice....

 

@Ric:

 

Can this be done thru GP? [i think i have a clue where already but too tired to go and look right now ]

 

@Geoff:

 

Looks good - nice find there geoff.

 

 

On a similar premise, whats a good syslog setup?

 

I found this on a quick google search:

 

http://www.kiwisyslog.com/

 

Does the Snare agent (and the syslog) use much resources? i.e. use it on a DC ok or not?

 

Regards

Nath

Cheers

Nath

[ninjabeaver]

OK, I'll follow these links up, but I want something that logs like WinSuite.

 

e.g.

 

nmason User logged on 11:32:06 29-09-05

 

nmason CMD.EXE C:\WINNT\system32\cmd.exe 11:32:12 29-09-05

 

nmason SMNDDP32.EXE Show Desktop 11:32:19 29-09-05

 

nmason KUDOS.EXE Kudos V5 11:32:56 29-09-05

 

nmason KUDOS.EXE Click here for information on health conditions. 11:33:20 29-09-05

 

nmason IEXPLORE.EXE http://www.park.norfolk.sch.uk/ - Microsoft Internet Explorer 11:34:48 29-09-05

 

nmason MSPUB.EXE (Unsaved Publication) - Microsoft Publisher 11:35:52 29-09-05

 

nmason MSPUB.EXE Windows Installer 11:36:10 29-09-05

 

nmason MSPUB.EXE Microsoft Office 2000 Professional 11:36:20 29-09-05

 

nmason MSPUB.EXE Microsoft Office 2000 Professional 11:36:48 29-09-05

 

nmason EXPLORER.EXE (Unsaved Publication) - Microsoft Publisher 11:37:08 29-09-05

 

nmason User logged off 11:37:27 29-09-05

 

 

Anything like that but more detailed that anybody could recommend?

 

I'm looking into the Audit side now as well.

[Geoff]

whats a good syslog setup?

 

Linux box here..

 

Does the Snare agent (and the syslog) use much resources? i.e. use it on a DC ok or not?

 

Just watch that disk space.

[jonny_valentine]

Stop advertising everywhere please

 

ChrisH

[DMcCoy]

NinjaBeaver:

 

 

 

Thats what we use.. logs everything, easily searchable and more.

 

It's what YOU SELL! See here

[jonny_valentine]

AM I NOT ALLOWED TO ANSWER PEOPLES QUESTIONS?! If something does the job, then why not make people aware of it?

 

I seriously think its unfair to dismiss my solution to the question.

 

WHY ARE YOU STOPPING NINJABEAVER FROM FINDING THE SOLUTION?

[Geoff]

So you've switched from Advertising to Flamebaiting. Nice.

[ajbritton]

At the risk of being shot down/deleted, I believe Ranger can monitor software usage (as well as provide other security functions). It's a while since I looked at it, and other board members feelings are quite strong about it. However, if you're moving up from WinSuite, it might be worth looking at.

[Ric_]

NetSupport DNA will also do software usage audits - along with remote control, hardware inventories, 'netsupport school' functions and much much more. It ain't cheap though - even Dos_box thought it was pricey and he has pots of cash to spend!

[Dos_Box]

I do not have 'pots of cash'!! It's 'oodles' thank you very much!

[Ric_]

I do not have 'pots of cash'!! It's 'oodles' thank you very much!

not 'pot oodles'?

[ChrisH]

I heard he has so much money he actually bought a very expensive printer and prints his own money!!!

[russdev]

dam it that measn that £1000 pound note wasnt real

 

Russ