Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am looking for a way to exclude specific file types from being logged in the security audits. I have a folder being audited for deletion events and the majority of logged events are .tmp files (such as a temp Word file that is automatically deleted when the app is closed) which I do not care about.

Would anyone know of a way to exclude these types of files from being logged?

Thanks in advance for any comments.

share|improve this question

1 Answer 1

I don't think that's possible. To get around such issues, and to make it easier to generate readable reports, I use Perl to read the event logs and store the events of interest in a database, MySQL in my case. From there I use Access as a front end because it can produce pretty reports without much effort.

The hardest thing about this is to tie together the various events that make up a single operation, such as a delete, bearing in mind that in many cases other events may be logged in between. In effect you need to create a stateful filter.

share|improve this answer
    
Thanks for your answer. I was afraid that this may be the case. –  Mozez May 5 '10 at 3:08
    
Ah yes, but wouldn't it be nice if someone came along and proved me wrong? ;) –  John Gardeniers May 5 '10 at 3:26

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.