How to enable File System Auditing on File server using Change Auditor (4255630)

Please follow below steps to audit any File server:

1. Please make sure you have Change Auditor for File Server license is installed in Change Auditor.

2. Check if Change Auditor agent is installed on that server and Change Auditor agent service is up and running.

3. Next, we need to create File system audit template in which we specify the path we need to audit - that should be always local path to that server, which events we need to audit and any specific exclusions that we do not need to audit if any.

For this to achieve, follow below steps:

Go to Client - View - Administration and in opened Administration Task window, go to Auditing - Server - File System

Click Add.

In newly opened window, give your template name and select the local path of File server where Files are located.(If any specific file, select file and if files are located under specific folder, select folder button)

Click Add.

Under File system auditing Events

Next and in next screen, type *.* and click OK.

Click Next and Finish.

4. Nest step, we should create configuration by enabling the template that we created.

In order to do so. Go to Configurations, Add that configuration with any name. Go to right side on the same screen and click Yes instead of No for that template that you just created.

Click Apply and OK.

5. Assign this configuration to specific file server that we need to audit. Simply Right click File server - Assign and select that configuration and Refresh the screen.

6. Next, create search and Run it.

Go to Searches - New Search and under What - Add with down arrow - Subsystem - File systems and in newly opened window, give local path to that server and click OK.

Save this Search and Run.

As per your requirement, give time range for which you need report. You can simply go to When and select time range.

Please refer below video that can show you how to perform above steps: