EventSentry can export event log and/or Syslog data to any file in one of the following formats:
•ASCII
•XHTML
•CSV
Filename
The name of the output file, supports runtime variables such as $YEAR, $MONTH, $DAY etc.
If you choose XHTML as the file type and have an existing action file (not created by EventSentry), then the specified file will be overwritten.
Delimiter
Specify a delimiter, the default delimiter is a comma (CSV only).
File Type
The desired output format: Plain, (X)HTML or CSV.
When using the (X)HTML option you can also configure the font and size used in the (X)HTML emails. The default is Verdana at 11px.
|
Click here to view a Frequently Asked Questions entry for this action. |
Digital File Signing
Files can be digitally signed with OpenSSL which is included in the EventSentry installation (\resources\openssl sub directory). Digitally signing files has the following prerequisites and limitations:
•Files can only be digitally signed on the collector, as such it's necessary that a collector is active and that the action is configured to use the collector
•It's required to use variables in the file name, which creates dynamic files, since files can only be digitally signed once the file is closed and a new file is created. The recommended file name is <PathToLogFolder>\$YEAR\$MONTH\$DAY\$HOUR\$YEAR_$MONTH_$DAY_$HOUR_$MINUTE.txt
•Signing has be initialized via the "Initialize" button before files can be signed. Initializing creates the required public and private key files.
•The host where files are signed needs to have access to an online time stamping service (https://www.freetsa.org/ by default) which protects against tampering
•Adds processing overhead, especially for large files
•Verifying signatures is a manual process done with scripts, there is no UI available
•For enhanced protection against tampering, consider storing files on remote WORM volumes
Initializing
Clicking the Initialize button will create a public/private keypair and download certificates from freetsa.org. All files are stored in the LogSigning sub directory of the main installation directory (e.g. C:\Program Files\EventSentry\LogSigning) and will include:
•es_logsign_private.pem
•es_logsign_public.pem
•freetsa\cacert.pem
•freetsa\tsa.crt
Clicking "Initialize" will call the script scripts\logsigning\log_init.cmd which can also be called manually.
File Signatures
After an output file has been closed, EventSentry will trigger file signing through the scripts\logsigning\log_sign.cmd script. And output file is closed when the dynamic file name changes due to current time. For example, the file
D:\EventLogs\2025\12\15\22\2025_12_15_22_37.txt
will be closed at 22:38:00 that day, when the new file
D:\EventLogs\2025\12\15\22\2025_12_15_22_38.txt
will be created. After a file is signed, 3 additional files will be generated with the following extensions:
•.sig (the actual file signature)
•.tsq (timestamp request file)
•.tsr (timestamping response file)
For the example above, the following files will exist after the file has been signed:
D:\EventLogs\2025\12\15\22\2025_12_15_22_37.txt
D:\EventLogs\2025\12\15\22\2025_12_15_22_37.txt.sig
D:\EventLogs\2025\12\15\22\2025_12_15_22_37.txt.tsq
D:\EventLogs\2025\12\15\22\2025_12_15_22_37.txt.tsr
|
None of the generated files should be deleted, these files are required for a potential signature verification in the future. |
Verifying Log Sigatures
The scripts\logsigning\log_verify.cmd script can be used to verify the digital signature of a file. The script takes the file name to verify as a single command line argument, for example:
C:\Program Files\EventSentry\scripts\logsigning\log_verify.cmd D:\EventLogs\2025\12\15\22\2025_12_15_22_37.txt
If the verification was successful, the output of log_verify.cmd should be similar to what is shown below and include the text FILE SIGNED, TIMESTAMPED, AND VERIFIED:
Signature verification: OK
Timestamp verification: OK
TIMESTAMP DETAILS:
Policy OID: tsa_policy1
Serial number: 0x01BEECDB
Time stamp: Dec 15 22:37:03 2025 GMT
======================================
FILE SIGNED, TIMESTAMPED, AND VERIFIED
======================================
|
It's of utmost importance to manually verify the Time stamp value, which needs to match the name of the file and/or the log file data. If the file was generated on Dec 10th but the time stamp shows Dec 15th, then it implies that the file was potentially modified after it was originally created and re-signed later. |
Enhanced Tampering Protection
As explained above, since administrators who have access to the EventSentry server can technically modify & resign log files, it's important that time stamping is used which would reveal post-signing tampering. Still it is recommended to store the logs and their associated files on one of the following types of remote media:
•A remote server to which the EventSentry server and its administrators only have WRITE (not MODIFY) access. This server should ideally not be part of the domain and be administered by a different individual/group
•A remote NAS which supports WORM volumes, where data which is written cannot be modified or deleted by anyone, even the NAS administrator
