1

How can I see the users on the server opening files and making changes on the server?

4
  • Fairly simple: If you trust the users, grant them access - if you don't trust them, do not give them access!
    – scunliffe
    Jul 2, 2010 at 16:58
  • I believe this question is highly dependent on what OS you run on your server
    – txwikinger
    Jul 2, 2010 at 17:19
  • Unless you are writing the server (in which case speak up), this is a Server Fault type question. It will be moved there once a quorum of user with 3k+ rep vote for that action. For future reference you might check the faq for site selection hints. Jul 4, 2010 at 4:44
  • The use of the vbscript tag, although being completely irrelevant to the question, suggests this is a Windows environment. Jul 4, 2010 at 22:04

3 Answers 3

1

For Windows servers you can use DiskPulse, which is capable of monitoring file systems and showing all changes in real-time.

http://www.diskpulse.com

0

sar is probably the closest existing utility that does what you want. If you are using the grsecurity patches on your kernel, you could place the machine in gbac audit mode and log the data that way.

0

You can enable file-level auditing on Windows through the security event log.

Goto to your local security policy in the computer management MMC, in Local policies, then Audit Policies, enable 'audit object access' so successful (or failed) access is recorded. Here's a MS support article about it.

If you enable audits on success, then expect to see a lot of entries in your security event log.

An alternative is to run an intrusion detection system like Aide regularly to see what files have been changed since the last run.