Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am looking for a way to exclude specific file types from being logged in the security audits. I have a folder being audited for deletion events and the majority of logged events are .tmp files (such as a temp Word file that is automatically deleted when the app is closed) which I do not care about.

Would anyone know of a way to exclude these types of files from being logged?

Thanks in advance for any comments.

share|improve this question

I don't think that's possible. To get around such issues, and to make it easier to generate readable reports, I use Perl to read the event logs and store the events of interest in a database, MySQL in my case. From there I use Access as a front end because it can produce pretty reports without much effort.

The hardest thing about this is to tie together the various events that make up a single operation, such as a delete, bearing in mind that in many cases other events may be logged in between. In effect you need to create a stateful filter.

share|improve this answer
Thanks for your answer. I was afraid that this may be the case. – Mozez May 5 '10 at 3:08
Ah yes, but wouldn't it be nice if someone came along and proved me wrong? ;) – John Gardeniers May 5 '10 at 3:26

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.