A method of collecting and storing information that can be used to track system activity, such as authentication attempts, configuration modifications, and stopping and starting of services.