Visit Randy's SharePoint section at UltimateItSecurity.com.

See a list of event IDs generated by LOGbinder for SharePoint.

"Nothing" and "no" are the short answers. LOGbinder for SharePoint is a Windows service that runs independently of SharePoint. There are NO changes to SharePoint whatsoever other than configuring SharePoint's audit feature and purging the SharePoint audit log of old events if you configure LOGbinder for SharePoint to do so.

No, the LOGbinder for SharePoint service is a tiny executable program that efficiently checks the SharePoint audit log for entries and uses limited resources while processing events.

LOGbinder for SharePoint runs at a lower priority than SharePoint, so it will never compete with SharePoint for resources.

Your SharePoint audit policy has the biggest impact on what resources LOGbinder needs; for each site collection, consider whether you really need to audit read/view access.

LOGbinder is fully integrated with Windows security and complies with widely accepted secure design and coding techniques.

At installation, LOGbinder secures the folder permissions where the software files reside. To protect LOGbinder's configuration from tampering, LOGbinder encrypts its configuration data.

LOGbinder security requirements are greatly simplified since LOGbinder does not store your audit log data. LOGbinder is designed to quickly get audit events out of the SharePoint audit log and to the destination of your choice, at which point your log management solution takes over. If you configure LOGbinder for SharePoint to direct events to the Windows security log, you leverage the significant effort Microsoft has invested in protecting the security log. And if you are already collecting Windows security logs with your log management application, SharePoint events will automatically be included when you install LOGbinder for SharePoint.

LOGbinder for SharePoint's design helps you fulfill separation of duty and audit trail integrity requirements by quickly getting audit events off the system where they are produced (and thus vulnerable to intruders or malicious administrators) and into your separate and secure log management system.

LOGbinder for SharePoint installs in about 2 minutes and only requires a few settings:

1. Select which site collections for LOGbinder to translate the audit log
2. Specify the user account LOGbinder should run as
3. Choose whether to output events to the custom LOGbinder SP event log, to the actual Windows Security Log, syslog or to a text file.

Check the Application log for warnings or errors from source LOGbndSE.

These are functions of a log management solution. LOGbinder complements and enhances the value of your log management solution.

With LOGbinder, any log management solution that supports Windows event logs, text file or syslog can now collect, monitor, archive, and report on SharePoint audit log activity. Also, see next Q&A.

LOGbinder can output to either the Windows Security Log, syslog, text file, or a custom Windows event log called LOGbinder for SharePoint.

See pricing and licensing information.

You do not need to install LOGbinder for SharePoint on a production SharePoint server.

The SharePoint object model classes that provide access to the SharePoint audit log require code to run locally. To audit a given SharePoint farm, LOGbinder for SharePoint needs to be installed on just one of the servers to fully audit the farm. This can be an existing SharePoint production server or a new server you deploy for LOGbinder for SharePoint (usually a virtual machine).

The account used to run the LOGbinder application must be a member of the server's local Administrators group and a SharePoint farm administrator. The account you choose for the LOGbinder service (which can be the same) must also be a SharePoint farm administrator and an administrator on each site collection being monitored. These requirements come from SharePoint in order to access the SharePoint audit log. This account needs to be authorized to run as a service, and if outputting the Security log, must be authorized to write to the Security log.

Yes. With LOGbinder for SharePoint you can configure the SharePoint audit policy and enable/disable translation of the audit log for each site collection on the SharePoint server.