Auditing
Another option you might need to consider is auditing, which is the process of creating a database that records particular events that occur on your network. Generally, you can decide what events to audit, from application information to security options. Figure 8.1 shows one of many different auditing windows in Windows NT.