Change Auditor 7.5 - User Guide

Inclusions tab

Inclusions tab

You must enter a file mask on the Inclusions tab to specify what is to be audited in the selected audit path. Use the following characters to specify a file mask on the Inclusions tab:

•	Fixed characters such as letters, numbers and other characters that are allowed in file names.

•	An asterisk (*) wildcard character to substitute zero or more characters.

•	Question mark (?) wildcard character to substitute a single character.

•	A double asterisk (**) to specify a recursive match. (find match in the folder and all subfolders in audit path).

NOTE: The slash (\) and double asterisk (**) characters can only be used with volumes.

Examples:

The following table provides some examples of file masks that can be used on the Inclusions tab of the auditing wizard. Note that <String> in this table may contain any of the file mask characters described above (i.e., fixed characters, * or ?).

Table 1. Inclusion examples

What to include in the audit:	Inclusion syntax/examples:
Include all files located anywhere in the audit path. NOTE: This is the most commonly used file mask.	Inclusion Syntax: *
Include all files with a specific file name regardless of its file extension.	Inclusion Syntax: <FileName>.* Example: Name.* Includes: Name.txt Name.docx Name.pdf
Include all files with a specific file extension.	Inclusion Syntax: <FileNameString>.<Ext> Example 1: *.tmp Includes: Files with a file extension of .tmp. Name.tmp Testing.tmp Example 2: ???*.doc Includes: Files whose name contains at least three characters with a file extension of .doc. MyTest.doc Testing123.doc 123.doc Example 3: ???test.doc Includes: Files whose name contains seven characters and ends in ‘test’ with a file extension of .doc. ABCtest.doc 123test.doc
Include all files with a specific file name that has a file extension of a specific length (number of characters).	Inclusion Syntax: <FileName>.<ExtString> Example 1: Name.??? Includes: Name.txt Name.tmp Name.pdf Example 2: Name.???? Includes: Name.docx Name.xlsx
Include all files that contain a specific string in their name and/or file extension.	Inclusion Syntax: <FileNameString>.<ExtString> Example: *name.??p Includes: Files whose name end with ‘name’ with a three character file extension that ends in the letter ‘p’. Myname.tmp Name.bmp

 

Exclusions tab

Exclusions tab

If you do not want to exclude anything (folders or files) in the audit path from auditing, skip this tab. However, if you want to exclude a specific folder/file or group of folders/files, use the following characters to specify what is to be excluded:

•	Fixed characters such as letters, numbers and other characters that are allowed in file names.

•	An asterisk (*) wildcard character to substitute zero or more characters.

NOTE: Use a single asterisk (*) to specify a non-recursive match (find match in the folder only; does not match any slash characters (\)). Use a double asterisk (**) to specify a recursive match (find match in the folder and all subfolders in audit path; matches slash characters (\) and directory names in paths).

•	Question mark (?) wildcard character to substitute a single character (does not match any slash characters (\).

NOTE: Be sure to select the appropriate Add option (Folder or File) when adding an exclusion or you may not get the results expected. That is, use Add | Folder to exclude the auditing of activity against files/subfolders in folder(s) that match the exclusion string. Use Add | File to exclude the auditing of activity against file(s) that match the exclusion string.

Exclusion examples

These examples show how to use file masks on the Exclusions tab of the auditing wizard. Note that <String> in these examples may contain any of the file mask characters described above (such as, fixed characters, * or ?).

•	Folder exclusion examples

•	Volume exclusion examples

•	All volume exclusion examples

Folder exclusion examples

Folder exclusion examples

Audit Path = Folder (<ShareName>\<FolderName>)

In the following examples the Audit Path is HOME\TEMP.

 

Table 2. Exclusion examples: Audit Path = Folder

What to exclude:	Exclusion syntax/examples:
Exclude activity against files/subfolders in the specified folder in the base audit path. (Add | Folder)	Exclusion Syntax: <FolderName> Example: DOCS Excludes: HOME\TEMP\DOCS
Exclude activity against files/subfolders in all folders that contain a specific string in their name, which are located in the base audit path. (Add | Folder)	Exclusion Syntax: <FolderNameString> Example 1: DOC* Excludes: HOME\TEMP\DOCS HOME\TEMP\DOCUMENTS Example 2: *DOC Excludes: HOME\TEMP\MYDOC Example 3: *DOC? Excludes: HOME\TEMP\DOCS HOME\TEMP\MYDOCX HOME\TEMP\PUBLICDOCS
Exclude activity against files/subfolders in all folders with a specific name found anywhere in the audit path. (Add | Folder)	Exclusion Syntax: **\<FolderName> Example: **\MYDOC Excludes: HOME\TEMP\MYDOC HOME\TEMP\DOCUMENTS\MYDOC HOME\TEMP\DOCS\PRIVATE\MYDOC
Exclude activity against a specific file in the base audit path. (Add | File)	Exclusion Syntax: <FileName.ext> Example: Test1.docx Excludes: HOME\TEMP\Test1.docx
Exclude activity against all files with a specific extension, which are located in the base audit path. (Add | File)	Exclusion Syntax: *.<ext> Example: *.tmp Excludes: HOME\TEMP\Doc1.tmp HOME\TEMP\Testing123.tmp
Exclude activity against all files with a specific file extension, which may be found anywhere in the audit path. (Add | File)	Exclusion Syntax: **.<ext> Example: **.tmp Excludes: HOME\TEMP\Doc1.tmp HOME\TEMP\DOCUMENTS\Testing.tmp
Exclude activity against all files that contain a specific string in their name and/or file extension, which are located in the base audit path. (Add | File)	Exclusion Syntax: <FileNameString>.<ExtString> Example 1: ??word.??? Excludes: Files whose name contains six characters and ends in ‘word’, with a three character file extension. HOME\TEMP\Myword.doc HOME\TEMP\12word.txt Example 2: *word*.??p Excludes: Files whose name contains the string ‘word’, with a three character file extension that ends with the letter ‘p’. HOME\TEMP\Word.tmp HOME\TEMP\Mywordtest.tmp HOME\TEMP\Nowords.bmp

Volume exclusion examples

Volume exclusion examples

Audit Path = Volume (<VolumeName>)

In the following examples, the volume name is Vol0 (Audit Path = Vol0); share names are HOME, SHARE2, and SHAREDDOCS.

NOTE: Volume names are case sensitive and must be entered correctly in the Audit Path field on the auditing wizard.

NOTE: When auditing an individual volume or all volumes, you must include the share name (or a file mask to represent the share) in the exclusion path. See examples below.

 

Table 3. Exclusion examples: Audit Path = Volume

What to exclude:	Exclusion syntax/examples:
Exclude activity against files/subfolders in a specific folder found in a specific location on the selected volume. (Add | Folder)	Exclusion Syntax: <ShareName>\<Path>\<FolderName> Example: HOME\USERS\TEMP\DOCS Excludes: Vol0\HOME\USERS\TEMP\DOCS
Exclude activity against files/subfolders in all folders whose name contains a specific string of characters found in a specific location on the selected volume. (Add | Folder)	Exclusion Syntax: <ShareName>\<Path>\<CharString> Example: HOME\USERS\TE?????DOCS Excludes: Vol0\HOME\USERS\TESTINGDOCS Vol0\HOME\USERS\TEMPORARYDOCS
Exclude activity against files/subfolders in all folders with the specified folder name which is located on a specific share. (Add | Folder)	Exclusion Syntax: <ShareName>\**\<FolderName> Example: HOME\**\DOCS Excludes: Vol0\HOME\DOCS Vol0\HOME\DEPTS\DOCS Vol0\HOME\USERS\TEMP\DOCS
Exclude activity against files/subfolders in all folders whose name starts with a specific string of characters which are located on a specific share. (Add | Folder)	Exclusion Syntax: <ShareName>\**\<CharString>* Example: HOME\**\DOC* Excludes: Vol0\HOME\DOCS Vol0\HOME\DEPTS\DOCS Vol0\HOME\USERS\TEMP\DOCS Vol0\HOME\USERS\DOCUMENTS
Exclude activity against files/subfolders in all folders with the specified folder name found in a specific path level on all shares on the selected volume. (Add | Folder)	Exclusion Syntax: *\*\<FolderName> Example 1: *\*\DOCS Excludes: Vol0\HOME\USERS\DOCS Vol0\HOME\DEPTS\DOCS Vol0\SHARE2\TEST\DOCS Example 2: *\*\*\DOCS Excludes: Vol0\HOME\USERS\TEMP\DOCS Vol0\SHARE2\PUBLIC\TEST\DOCS
Exclude activity against files/subfolders in all folders with the specified folder name which may be located anywhere on the selected volume. (Add | Folder)	Exclusion Syntax: **\<FolderName> Example: **\DOCS Excludes: Vol0\HOME\DOCS Vol0\HOME\DEPTS\DOCS Vol0\HOME\USERS\TEMP\DOCS Vol0\SHARE2\TEST\DOCS Vol0\SHARE2\PUBLIC\TEST\DOCS
Exclude activity against files/subfolders in all shares and folders whose name contains a specific string of characters which may be located anywhere on the selected volume. (Add | Folder)	Exclusion Syntax: **<CharString>* Example: **DOC* Excludes: Vol0\HOME\DOCS Vol0\HOME\MYDOCS Vol0\HOME\USERS\TEMP\DOCS Vol0\HOME\USERS\TEMPORARYDOCS Vol0\SHARE2\TEST\DOCS Vol0\SHARE2\PUBLIC\TEST\MYDOCS Vol0\SHAREDDOC
Exclude activity against files whose name contains a specific string of characters which may be found anywhere on the selected volume. (Add | File)	Exclusion Syntax: **<CharString>* Example: **DOC* Excludes: Vol0\HOME\Document1.tmp Vol0\HOME\DOCS\Testing.doc Vol0\HOME\USERS\TEMP\DOCS\BetaDoc.pdf Vol0\SHARE2\USERS\DOCS\Test1.docx Vol0\SHARE2\PUBLIC\MYDOCS\OldDocPlan
Exclude activity against a specific file found in a specific location on the selected volume. (Add | File)	Exclusion Syntax: <ShareName>\<Path>\<FileName.Ext> Example: SHARE2\USERS\DOCS\Test1.docx Excludes: Vol0\SHARE2\USERS\DOCS\Test1.docx
Exclude activity against files with a specific file name (regardless of the file extension) which may be located anywhere on the selected volume. (Add | File)	Exclusion Syntax: **\<FileName>.* Example: **\test1.* Excludes: Vol0\HOME\DEPTS\DOCS\test1.docx Vol0\HOME\USERS\TEMP\DOCS\test1.docx Vol0\HOME\USERS\DOCUMENTS\test1.pdf Vol0\SHARE2\TEST\DOCS\test1.txt
Exclude activity against files with the specified file extension found in a specific location on the selected volume. (Add | File)	Exclusion Syntax: <ShareName>\<Path>\*.<Ext> Example: SHARE2\TEST\DOCS\*.docx Excludes: Vol0\SHARE2\TEST\DOCS\Test1.docx Vol0\SHARE2\TEST\DOCS\MyInfo.docx
Exclude activity against files with the specified file extension which may be located anywhere on the selected volume. (Add | File)	Exclusion Syntax: **\*.<Ext> Example: **\*.pdf Excludes: Vol0\HOME\MYDOCS\Final.pdf Vol0\HOME\DEPTS\DOCS\Test123.pdf Vol0\HOME\USERS\DOCUMENTS\Test1.pdf Vol0\SHARE2\TEST\DOCS\Current.pdf Vol0\SHARE2\PUBLIC\TEST\MYDOCS\Ex.pdf