Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I am currently setting up a file server with win2k8 server r2 (storage server) I was wondering is there something I can use to audit/log what happens?

For example

JSmith moved Folder1 to Root. JSmith created XYZ folder.

etc. Directory Monitor doesn't show users (which is important) http://www.deventerprise.net/Projects.aspx

Obviously something with low overhead would be awesome too.

Thanks in advance

share|improve this question

5 Answers 5

up vote 3 down vote accepted

If you are open to spending a little bit of money to get reports that are easily generated and easy to read, I highly recommend File System Auditor by Scriptlogic.

http://www.scriptlogic.com/products/filesystemauditor/

This software lets you create custom reports showing any activity in any folder, by any user, and any type of event. It is orders of magnitude easier to read and use than the default auditing built into Windows Server. I use it on my file server which is running Server 2003 but I am sure it will run great on 2008 as well.

share|improve this answer
    
Does this track folder moves and renames? Thanks. –  Kvad May 16 '10 at 23:34
    
Yup sure does. It actually shows the original name of the file or folder, then the destination file or folder name. –  user10711 May 18 '10 at 16:31

You can enable auditing on Windows Server and use Logparser to parse the logs to suit your needs. Logparser is a free tool from Microsoft. It allows you to parse *.evt logs to any format you like (fixed column length, csv, txt, graphs etc.). The SQL like syntax is very flexible in extracting the relevant information.

share|improve this answer

You need to turn on Auditing on. Check the following link for a an explanation of how to enable auditing and track what is happening. Overhead should not be an issue if properly set up, ; ex add only certain users in the audit versus everyone.

http://www.intelliadmin.com/index.php/2008/03/use-auditing-to-track-who-deleted-your-files/

share|improve this answer
    
Thats on now, but is there anything to use it for nice reporting tools ? –  Kvad May 14 '10 at 6:21

for nice reporting use http://www.eventlogxp.com/

Hope this helps!

share|improve this answer

This might be what you are looking for: Win Server 2008

This solution involves turning on Windows Server built in Audit policy for files and folders.

Excerpt:"To enable file and folder auditing for a single server, select Start -> All Programs -> Administrative Tools -> Local Security Policy"

share|improve this answer
    
Merely linking to an article and not explaining it in the text of your answer is not in-line with the intent of this site. –  mfinni May 17 '12 at 12:49
    
Edited. Please upvote it now. –  Dragos May 18 '12 at 12:43
    
That's only half of the relevant instructions - you then have to turn on auditing for the files and/or folders you care about. –  mfinni May 18 '12 at 15:47

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.