Server log cleanup and IIS log cleanup

First introduce the default location of the log, only we know the traces left on the server, in order to erase the traces we left in the computer, and the log is where we left the mark.

Security log file: C:\\WINDOWS\\system32\\config\\SecEvent.Evt

System log file: C:\\WINDOWS\\system32\\config\\SysEvent.Evt

Application log File: C:\\WINDOWS\\system32\\config\\AppEvent.Evt

FTP log default location: C:\\WINDOWS\\system32\\Logfiles\\MSFTPSVC1

WWW log default location: C:\\WINDOWS \\system32\\Logfiles\\W3SVC1

However, these logs cannot be deleted when the system is running normally. FTP and WWW services can stop these two services first, then delete the log files, but it is safe. System and application log daemon service Event Log is no way to stop. So how do you need to clean it?

Because this step is difficult to do this manually. So we can use the tool. Here I give The tool that everyone talks about is CL. Can clean up IIS logs. FTP logs `. Schedule task logs. System logs. Clean up service logs only need to execute

CL tool cleanup command

Cleanup service log: cl -logfiles 127.0.0.1 (The program automatically stops the FTP.WWW.Task Scheduler service before deleting the log, and then starts three services.)

Clean up the system log: cl -enentlog all

This tool supports remote cleaning Of course, the prerequisite must be an IPC management connection with administrator privileges established.

Connection command: net use \\\\ip\\ipc$ password/user:username

Then use CL -LogFile IP Remotely clean up the host.

============================================== ==============================================================================

At present, the intrusion method for the website is mainly to inject, and then the right to take down the server, so the main log traces are left in the IIS log, so we only need to clear the IP address in our IIS log. That's it. If you clean it up, it won't make the other administrators suspicious. So really want to Let's stop the IIS service, and then use Notepad to open the log file and change it a bit. Of course not. Just use the CleanIISLog tool to get it easily.

Usage of the CleanIISLog tool: in CMD Execute the CleanIISLog. IP address to clear the connection records about IP in all IIS logs, and keep other IP records.

After clear success, CleanIISLog will make its own running record in the system log. If IIS If the log file is not the default, you can execute the CleanIISLog IIS log path server IP address to specify the path to the IIS log. Note: This tool can only be run locally and must have Administrators privileges.