up vote 2 down vote favorite
2
share [g+] share [fb]

I am currently setting up a file server with win2k8 server r2 (storage server) I was wondering is there something I can use to audit/log what happens?

For example

JSmith moved Folder1 to Root. JSmith created XYZ folder.

etc. Directory Monitor doesn't show users (which is important) http://www.deventerprise.net/Projects.aspx

Obviously something with low overhead would be awesome too.

Thanks in advance

link|improve this question
89% accept rate
feedback

6 Answers

up vote 3 down vote accepted

If you are open to spending a little bit of money to get reports that are easily generated and easy to read, I highly recommend File System Auditor by Scriptlogic.

http://www.scriptlogic.com/products/filesystemauditor/

This software lets you create custom reports showing any activity in any folder, by any user, and any type of event. It is orders of magnitude easier to read and use than the default auditing built into Windows Server. I use it on my file server which is running Server 2003 but I am sure it will run great on 2008 as well.

link|improve this answer
Does this track folder moves and renames? Thanks. – Kvad May 16 '10 at 23:34
Yup sure does. It actually shows the original name of the file or folder, then the destination file or folder name. – user10711 May 18 '10 at 16:31
feedback
up vote 1 down vote

You can enable auditing on Windows Server and use Logparser to parse the logs to suit your needs. Logparser is a free tool from Microsoft. It allows you to parse *.evt logs to any format you like (fixed column length, csv, txt, graphs etc.). The SQL like syntax is very flexible in extracting the relevant information.

link|improve this answer
feedback
up vote 1 down vote

You may want to take a look at our monitoring solution EventSentry as well, it includes a lot of compliance tracking functionality, and part of that is "File Access Tracking".

It intercepts Windows auditing events, parses and normalizes them for better and easier understanding. Plus, you get a lot other functionality as well.

I can't say how it compares with File System Auditor, since that product seems to solely focus on file access, but there is a good chance it offers all the functionality you need. Plus, a single license (which is all you would need for one host) is only $85.

link|improve this answer
feedback
up vote 0 down vote

You need to turn on Auditing on. Check the following link for a an explanation of how to enable auditing and track what is happening. Overhead should not be an issue if properly set up, ; ex add only certain users in the audit versus everyone.

http://www.intelliadmin.com/index.php/2008/03/use-auditing-to-track-who-deleted-your-files/

link|improve this answer
Thats on now, but is there anything to use it for nice reporting tools ? – Kvad May 14 '10 at 6:21
feedback
up vote 0 down vote

for nice reporting use http://www.eventlogxp.com/

Hope this helps!

link|improve this answer
feedback
up vote 0 down vote

This might be what you are looking for: Win Server 2008

This solution involves turning on Windows Server built in Audit policy for files and folders.

Excerpt:"To enable file and folder auditing for a single server, select Start -> All Programs -> Administrative Tools -> Local Security Policy"

link|improve this answer
Merely linking to an article and not explaining it in the text of your answer is not in-line with the intent of this site. – mfinni May 17 at 12:49
Edited. Please upvote it now. – Dragos May 18 at 12:43
That's only half of the relevant instructions - you then have to turn on auditing for the files and/or folders you care about. – mfinni May 18 at 15:47
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.