IT Infrastructure health checkup

@Dashrender we do it monthly with a pizza supplied by our boss as motivation. Caught some fun stuff early that would otherwise have caused issues.

Monthly? I ain't nobody got time for going through logs manually every month. I think you could save a lot of money in man hours by automating it.

MattSpeller

@thecreativeone91 it's an afternoon for 3 people & good excuse to talk about issues and potential solutions far less formally than weekly meetings

dafyre

@MattSpeller Probably far more productive too since things are not formal.

dafyre

@MattSpeller said:

@Dashrender we do it monthly with a pizza supplied by our boss as motivation. Caught some fun stuff early that would otherwise have caused issues.

Edit: manually; lift pizza to face with left hand, mouse wheel scroll and coke in right.

Would be a good idea to set up an ELK loggin infrastructure so you can see all o fthe issues in one place while exercising your arms.

scottalanmiller

@thecreativeone91 said:

@MattSpeller said:

@Dashrender we do it monthly with a pizza supplied by our boss as motivation. Caught some fun stuff early that would otherwise have caused issues.

Monthly? I ain't nobody got time for going through logs manually every month. I think you could save a lot of money in man hours by automating it.

Of course, if doing monthly. When you are doing it internally, I think log management is a must. ELK, Splunk, Loggly, whatever. If it is a client that refuses log management, manual might be a requirement.

scottalanmiller

@dafyre said:

@MattSpeller said:

@Dashrender we do it monthly with a pizza supplied by our boss as motivation. Caught some fun stuff early that would otherwise have caused issues.

Edit: manually; lift pizza to face with left hand, mouse wheel scroll and coke in right.

Would be a good idea to set up an ELK loggin infrastructure so you can see all o fthe issues in one place while exercising your arms.

If you aren't ready to manage ELK, Loggly is low cost and very nice. I like the product and the team. Good people.

dafyre

While on this topic... what are some good tools for getting Windows Event Logs into something like ELK?

coliver

@dafyre said:

While on this topic... what are some good tools for getting Windows Event Logs into something like ELK?

http://nxlog.org/

dafyre

@coliver Thanks. That one looks pretty slick.

coliver

@dafyre said:

@coliver Thanks. That one looks pretty slick.

I've been trying to get it working for a bit. I really like the Kibana interface I just need to get NXLog and Logstash working together.

Ambarishrh

Lets assume this is a one time job for a client, I would assume the tools would be:

BPA for the corresponding MS product
Lynis for Linux security Audit
For exchange, points mentioned by @Breffni-Potter
AD- tools suggested by @thecreativeone91
OpenVAS or Nexpose or Nessus or GFI Languard
MBSA
Sydi for network documentation

Not sure on a one time audit, if we can use some sort of log management

Deleted74295

Yes you have to check logs for a one time audit, otherwise what's the point?

If the DC is screaming about an easily preventable group policy conflict, how will you pick that up apart from logs?

@Breffni-Potter said:

Yes you have to check logs for a one time audit, otherwise what's the point?

If the DC is screaming about an easily preventable group policy conflict, how will you pick that up apart from logs?

Automation can still be done on the logs so it's not a manual process of looking through everything. It will also centralize it.

Also a DC is not going to tell you about a GP conflict, that's client side. RoSP or GPresult on the client machine will tell you about those. However, the are avoided by using enforced GPOs where needed. However aside from the setting not being applied there's no actual harm to GP conflicts.

Deleted74295

@thecreativeone91 said:

However aside from the setting not being applied there's no actual harm to GP conflicts.

Speaking broadly, with a badly setup GP you can get delayed logins and other strange issues.

@Breffni-Potter said:

@thecreativeone91 said:

However aside from the setting not being applied there's no actual harm to GP conflicts.

Speaking broadly, with a badly setup GP you can get delayed logins and other strange issues.

Not from conflicting settings you won't get delayed logins. Conflicting settings will just allow one to override the other.

Delayed logins come from permissions issues, trying to do to much, bad settings or corrupt Sysvol and too much WMI filtering.