Copyright: CyberSafe Event Viewer, ©1998-1999 CyberSafe Corporation
Citation: CyberSafe Event Viewer Online Help, ©1998-1999 CyberSafe Corporation


Welcome to the CyberSafe Event Viewer
Welcome to the CyberSafe® Event Viewer

The CyberSafe Event Viewer allows you to view the event logs from both Windows NT and Sun Solaris computers. The CyberSafe Event Viewer is similar to the Event Viewer provided with Windows NT, with the following exceptions:

•	Provides a Multiple Document Interface (MDI) so you can view multiple event logs at a time.

•	Can be launched as a separate program from Start > Programs, or can be launched from within the program.

•	Opens event logs generated on both Windows NT and Solaris computers.

Note

Use the CyberSafe Event Viewer to view event logs that have been saved, such as those saved by Centrax in the \Archive subdirectory. You cannot use the CyberSafe Event Viewer to view current event logs.

Related topics

About the Event Log window

Viewing event details

Filtering events


CyberSafe Event Viewer Application Window

This is the main application window that appears when you launch the CyberSafe Event Viewer. To view event log files, choose File > Open and locate the event file you want to view (usually named with the .evt file extension).

The CyberSafe Event Viewer provides a Multiple Document Interface (MDI), so you can view multiple event log files at a time. You can also view Solaris event files using the CyberSafe Event Viewer.

To open an event log:

Choose File > Open and use the Open dialog box locate the event log file.

To view/hide the status bar:

Choose View > Status Bar. A check next to this option indicates the status bar is showing.

Related topics

Viewing events

Filtering events


Event Log Window

The Event Log window appears when you choose File > Open. This window displays the contents of the event log file. To view the details of a specific event, double-click the event.

Tip

To reduce the number of events displayed, apply a filter by choosing View > Event Filter. After you have specified a filter, apply the filter by choosing View > Filter Events. To remove the filter, choose View > All Events.

No. The number of the event in the event log file.

Date The date the event was logged.

Time The time the event was logged.

Source The originating area in which the event was logged. The source for NT event logs is Security (NT). The source for Solaris event logs is Solaris.

Category On NT, the classification of the event. Categories can be Account Management, Detailed Tracking, Logon and Logoff, Object Access, Policy Change, Privilege Use, and System Event. This field does not apply for Solaris events.

Event The event identification number relevant to the platform. For example, NT events are identified using numbers unique to NT and Solaris events are identified using numbers unique to Solaris.

User The user’s SID (on NT) or the user audit ID (on Solaris).

Computer The computer on which the event occurred.

Related topics

Viewing event details

Filtering events


Event Filter dialog box

This dialog box appears when you choose View > Event Filter. Use this dialog box to specify the events you want displayed in the current event log file.

Tip

After you have specified a filter, to apply the filter choose View > Filter Events. To remove the filter, choose View > All Events.

Range To filter a range of events, check the From and To boxes and specify the date and time range. To filter a range of events with a specific start and an undetermined end date, just check the From box and specify the date and time. To filter a range of events with an undetermined start date and a specific end date, just check the To box and specify the date and time.

Type  To specify the type of events you want to view, check the boxes.

Information
Warning
Error
Success Audit
Failure Audit
Other

Source Enter the name of the source of the events you want to view. Enter one source only. To view only those events that were generated on NT, enter Security (NT). To view only those events that were generated on Solaris, enter Solaris.

Category Enter the name of the category of events you want to view. Enter one category only. This field applies only to NT events. Categories can be Account Management, Detailed Tracking, Logon and Logoff, Object Access, Policy Change, Privilege Use, and System Event.

User Enter the user’s SID (on NT) or the user’s ID (on Solaris). Enter one user only.

Computer Enter the name of the computer on which the event occurred. Enter one name only.

Event ID Enter the event identification number relevant to the platform. For example, NT events are identified using numbers unique to NT and Solaris events are identified using numbers unique to Solaris. Enter one event ID only.


Event Details dialog box

This dialog box appears when you double-click an event (or choose View > Details). Use this dialog box to view the details of the event.

Date Displays the date the event occurred.

Time Displays the time the event occurred.

User Displays the SID (on NT systems) or the user ID (on Solaris systems) of the user who caused the event to occur.

Computer Displays the computer name on which the event occurred.

Event ID Displays the event identification number relevant to the platform. For example, NT events are identified using numbers unique to NT and Solaris events are identified using numbers unique to Solaris.

Source Displays the originating area in which the event was logged. The source for NT event logs is Security (NT). The source for Solaris event logs is Solaris.

Type Displays the type of the event:

Information
Warning
Error
Success Audit
Failure Audit
Other

Category Displays the classification of the event. Categories can be Account Management, Detailed Tracking, Logon and Logoff, Object Access, Policy Change, Privilege Use, and System Event. This field does not apply to Solaris events.

Description Displays more detailed information on the event.


Events logged by successful operations, such as when a user logs on or off a computer. This type of event usually occurs on NT systems.


Events that provide information about possible future problems, such as when disk space is running low. This type of event usually occurs on NT systems.


Events that indicate significant problems, such as loss of data or loss of functions. This type of event usually occurs on NT systems.


Audited security access attempts that were successful, such as a successful logon. This type of event occurs on both NT and Solaris systems.


Audited security attempts that failed, such as a failed logon. This type of event occurs on both NT and Solaris systems.


Audited events or messages not previously classified. This type of event usually occurs on a Solaris system.