New answers tagged audit
I believe I stopped logging logon/logoff events by: Opening local security policy Security Settings->Advanced Audit Policy Configuration-> System Audit Policies->Logon/Logoff: By default both Audit Logoff and Audit Logon are not configured. Right click each-Properties. Check Configure the following audit events. Do not check Success or Failure. After I ...
if you want to debug something I would,recommend to use strace on the process. Filter strace with -e i.e. strace -eopen and redirect the out to a file. Then take the trace parse the open requests and make the histogram by a script.
Monitoring file accesses. You can use the linux auditd daemon to do that. apt-get install auditd auditctl -a always,exit -F dir=/var -F pid=1005 And it should start logging (on Ubuntu, to /var/log/audit/audit.log by default) all accesses to files in /var made by pid 1005. You can fine-tune the rules to filter more precisely what you want to log. ...
There are a number of programs that can help you with that: Power Admin's PA File Sight Netfort's LANGuardian ISDecisions' FileAudit NetWrix File Server Change Reporter among others.
Top 50 recent answers are included