Log Parser Log Parser Log Parser Log Parser
![Log. Parser Log. Parser](https://slidetodoc.com/presentation_image_h/11421933642efd0f6c1568c74c7ab936/image-1.jpg)
![목차 Log. Parser 설명 Log Parser 활용 Log. Parser 사용법 예제 정리 목차 Log. Parser 설명 Log Parser 활용 Log. Parser 사용법 예제 정리](https://slidetodoc.com/presentation_image_h/11421933642efd0f6c1568c74c7ab936/image-2.jpg)
![](https://slidetodoc.com/presentation_image_h/11421933642efd0f6c1568c74c7ab936/image-3.jpg)
![](https://slidetodoc.com/presentation_image_h/11421933642efd0f6c1568c74c7ab936/image-4.jpg)
![](https://slidetodoc.com/presentation_image_h/11421933642efd0f6c1568c74c7ab936/image-5.jpg)
![](https://slidetodoc.com/presentation_image_h/11421933642efd0f6c1568c74c7ab936/image-6.jpg)
![사용법 >Log. Parser. exe –i: evt –o: 출력형식 “SELECT필드명 [INTO 출력파일명] FROM Security|Application|System WHERE조건 사용법 >Log. Parser. exe –i: evt –o: 출력형식 “SELECT필드명 [INTO 출력파일명] FROM Security|Application|System WHERE조건](https://slidetodoc.com/presentation_image_h/11421933642efd0f6c1568c74c7ab936/image-7.jpg)
![](https://slidetodoc.com/presentation_image_h/11421933642efd0f6c1568c74c7ab936/image-8.jpg)
![사용법 TSV Logparser. exe –i: evt –o: tsv “SQL Query“ DATAGRID Logparser. exe –i: 사용법 TSV Logparser. exe –i: evt –o: tsv “SQL Query“ DATAGRID Logparser. exe –i:](https://slidetodoc.com/presentation_image_h/11421933642efd0f6c1568c74c7ab936/image-9.jpg)
![사용법 NEUROVIEW Logparser. exe –i: evt –o: neuroview “SQL Query“ CSV Logparser. exe –i: 사용법 NEUROVIEW Logparser. exe –i: evt –o: neuroview “SQL Query“ CSV Logparser. exe –i:](https://slidetodoc.com/presentation_image_h/11421933642efd0f6c1568c74c7ab936/image-10.jpg)
![예제#1 iexplore. exe 프로세스가 실행된 이벤트로그를 추출 SELECT INTO FROM WHERE Event. Log, Time. 예제#1 iexplore. exe 프로세스가 실행된 이벤트로그를 추출 SELECT INTO FROM WHERE Event. Log, Time.](https://slidetodoc.com/presentation_image_h/11421933642efd0f6c1568c74c7ab936/image-11.jpg)
![](https://slidetodoc.com/presentation_image_h/11421933642efd0f6c1568c74c7ab936/image-12.jpg)
![예제#2 특정 사용자(예, securityteam)의 터미널 서비스 로그온 이벤트로그 추출 SELECT INTO FROM WHERE OR 예제#2 특정 사용자(예, securityteam)의 터미널 서비스 로그온 이벤트로그 추출 SELECT INTO FROM WHERE OR](https://slidetodoc.com/presentation_image_h/11421933642efd0f6c1568c74c7ab936/image-13.jpg)
![](https://slidetodoc.com/presentation_image_h/11421933642efd0f6c1568c74c7ab936/image-14.jpg)
![예제#3 특정 사용자가 실행한 예약 작업에 대한 이벤트로그 추출 SELECT FROM WHERE Event. Log, 예제#3 특정 사용자가 실행한 예약 작업에 대한 이벤트로그 추출 SELECT FROM WHERE Event. Log,](https://slidetodoc.com/presentation_image_h/11421933642efd0f6c1568c74c7ab936/image-15.jpg)
![](https://slidetodoc.com/presentation_image_h/11421933642efd0f6c1568c74c7ab936/image-16.jpg)
![](https://slidetodoc.com/presentation_image_h/11421933642efd0f6c1568c74c7ab936/image-17.jpg)
![](https://slidetodoc.com/presentation_image_h/11421933642efd0f6c1568c74c7ab936/image-18.jpg)
![](https://slidetodoc.com/presentation_image_h/11421933642efd0f6c1568c74c7ab936/image-19.jpg)
![](https://slidetodoc.com/presentation_image_h/11421933642efd0f6c1568c74c7ab936/image-20.jpg)
- Slides: 20
![Log Parser Log. Parser](https://slidetodoc.com/presentation_image_h/11421933642efd0f6c1568c74c7ab936/image-1.jpg)
Log. Parser
![목차 Log Parser 설명 Log Parser 활용 Log Parser 사용법 예제 정리 목차 Log. Parser 설명 Log Parser 활용 Log. Parser 사용법 예제 정리](https://slidetodoc.com/presentation_image_h/11421933642efd0f6c1568c74c7ab936/image-2.jpg)
목차 Log. Parser 설명 Log Parser 활용 Log. Parser 사용법 예제 정리
![](https://slidetodoc.com/presentation_image_h/11421933642efd0f6c1568c74c7ab936/image-3.jpg)
![](https://slidetodoc.com/presentation_image_h/11421933642efd0f6c1568c74c7ab936/image-4.jpg)
![](https://slidetodoc.com/presentation_image_h/11421933642efd0f6c1568c74c7ab936/image-5.jpg)
![](https://slidetodoc.com/presentation_image_h/11421933642efd0f6c1568c74c7ab936/image-6.jpg)
![사용법 Log Parser exe i evt o 출력형식 SELECT필드명 INTO 출력파일명 FROM SecurityApplicationSystem WHERE조건 사용법 >Log. Parser. exe –i: evt –o: 출력형식 “SELECT필드명 [INTO 출력파일명] FROM Security|Application|System WHERE조건](https://slidetodoc.com/presentation_image_h/11421933642efd0f6c1568c74c7ab936/image-7.jpg)
사용법 >Log. Parser. exe –i: evt –o: 출력형식 “SELECT필드명 [INTO 출력파일명] FROM Security|Application|System WHERE조건 [ORDER BY필드명 ASC|DESC]” Event Log. Fields : Event. Log (S) Time. Written (T) Event. Type. Name (S) Source. Name (S) SID (S) Record. Number (I) Event. ID (I) Event. Category (I) Strings (S) Message (S) (S : string I : integer T : timestamp) Time. Generated (T) Event. Type (I) Event. Category. Name (S) Computer. Name (S) Data (S)
![](https://slidetodoc.com/presentation_image_h/11421933642efd0f6c1568c74c7ab936/image-8.jpg)
![사용법 TSV Logparser exe i evt o tsv SQL Query DATAGRID Logparser exe i 사용법 TSV Logparser. exe –i: evt –o: tsv “SQL Query“ DATAGRID Logparser. exe –i:](https://slidetodoc.com/presentation_image_h/11421933642efd0f6c1568c74c7ab936/image-9.jpg)
사용법 TSV Logparser. exe –i: evt –o: tsv “SQL Query“ DATAGRID Logparser. exe –i: evt –o: datagrid “SQL Query“
![사용법 NEUROVIEW Logparser exe i evt o neuroview SQL Query CSV Logparser exe i 사용법 NEUROVIEW Logparser. exe –i: evt –o: neuroview “SQL Query“ CSV Logparser. exe –i:](https://slidetodoc.com/presentation_image_h/11421933642efd0f6c1568c74c7ab936/image-10.jpg)
사용법 NEUROVIEW Logparser. exe –i: evt –o: neuroview “SQL Query“ CSV Logparser. exe –i: evt –o: csv “SQL Query“
![예제1 iexplore exe 프로세스가 실행된 이벤트로그를 추출 SELECT INTO FROM WHERE Event Log Time 예제#1 iexplore. exe 프로세스가 실행된 이벤트로그를 추출 SELECT INTO FROM WHERE Event. Log, Time.](https://slidetodoc.com/presentation_image_h/11421933642efd0f6c1568c74c7ab936/image-11.jpg)
예제#1 iexplore. exe 프로세스가 실행된 이벤트로그를 추출 SELECT INTO FROM WHERE Event. Log, Time. Written, Computer. Name, Message iexplorelog. txt Security (Event. ID=592) AND (EXTRACT_TOKEN(Strings, 1, '|') LIKE %iexplore. exe%') EXTRACT_TOKEN( argument <STRING>, index <INTEGER> [ , separator <STRING> ] ) EXTRACT_TOKEN(Strings, 1, ’|’) - Strings 필드를 ‘|’ 문자열로 분리했을 경우 1번(0번부터 시작) 문자열 필드 - Event. Log : 보안, 응용 프로그램, 시스템 로그 - Time. Written : 로그가 기록된 시간 - Computer. Name : 컴퓨터 이름 - Message : 로그 내용 Event Id 592 : 프로세스 생성
![](https://slidetodoc.com/presentation_image_h/11421933642efd0f6c1568c74c7ab936/image-12.jpg)
![예제2 특정 사용자예 securityteam의 터미널 서비스 로그온 이벤트로그 추출 SELECT INTO FROM WHERE OR 예제#2 특정 사용자(예, securityteam)의 터미널 서비스 로그온 이벤트로그 추출 SELECT INTO FROM WHERE OR](https://slidetodoc.com/presentation_image_h/11421933642efd0f6c1568c74c7ab936/image-13.jpg)
예제#2 특정 사용자(예, securityteam)의 터미널 서비스 로그온 이벤트로그 추출 SELECT INTO FROM WHERE OR AND Event. Log, Time. Written, Event. Type. Name, Event. Category. Name, Computer. Name, Message terminallog. txt Security ((Event. ID=528) AND (EXTRACT_TOKEN(Strings, 3, '|') LIKE '10')) ((Event. ID=529) AND (EXTRACT_TOKEN(Strings, 2, '|‘) LIKE '10')) (EXTRACT_TOKEN(Strings, 0, '|') LIKE 'securityteam') 필드 - Event. Type. Name : 성공감사, 실패감사 - (Event. Category)Event. Category. Name: (1)시스템이벤트 (2)로그온/로그오프 (3)객체 액세스 (4)권한사용 (5)세부추적 Event Id 528 : 로그온 성공 Event Id 529 : 로그온 실패 터미널 서비스로 로그인 한 경우 로그온 유형이 10번이므로 Strings 필드에서 10 이라는 문자열을 찾는 조건을 넣어주어 로그를 추출해 낸다.
![](https://slidetodoc.com/presentation_image_h/11421933642efd0f6c1568c74c7ab936/image-14.jpg)
![예제3 특정 사용자가 실행한 예약 작업에 대한 이벤트로그 추출 SELECT FROM WHERE Event Log 예제#3 특정 사용자가 실행한 예약 작업에 대한 이벤트로그 추출 SELECT FROM WHERE Event. Log,](https://slidetodoc.com/presentation_image_h/11421933642efd0f6c1568c74c7ab936/image-15.jpg)
예제#3 특정 사용자가 실행한 예약 작업에 대한 이벤트로그 추출 SELECT FROM WHERE Event. Log, Time. Written, Computer. Name, Message Security (Event. ID=602) AND (EXTRACT_TOKEN(Strings, 7, '|') LIKE ‘securityteam’) Event Id 602 : 예약 작업 생성 EXTRACT_TOKEN(Strings, 7, '|') LIKE ‘securityteam’) 으로 조건을 주어 특정사용자 (securityteam)의 예약 작업에 대해서 검색한다.
![](https://slidetodoc.com/presentation_image_h/11421933642efd0f6c1568c74c7ab936/image-16.jpg)
![](https://slidetodoc.com/presentation_image_h/11421933642efd0f6c1568c74c7ab936/image-17.jpg)
![](https://slidetodoc.com/presentation_image_h/11421933642efd0f6c1568c74c7ab936/image-18.jpg)
![](https://slidetodoc.com/presentation_image_h/11421933642efd0f6c1568c74c7ab936/image-19.jpg)
![](https://slidetodoc.com/presentation_image_h/11421933642efd0f6c1568c74c7ab936/image-20.jpg)
³log243=
Nilai dari 5log 10 + 5 log 50 - 5log 4 adalah...
Jika panjang ap 8 cm bq 5 cm
Jika diketahui log 2 = 0
Linear vs logarithmic
Akar pangkat 674
Jika log 2=0 301 nilai log 32 adalah
P log 243 = 5 maka p + 5 =
Dns debug log parser
Log parser studio
”common log format”
Power law log log plot
Log a/log b
Persamaan 7 log 217 + 7 log 31 ialah
Log form to exponential form
How to get rid of an x exponent
Hyper log
2t337
Log m-log n
Log k = log a - ea/rt
-18 ÷2 gives