Chat now with support
Chat with Support

Change Auditor for Windows File Servers 7.0.2 - User Guide

File System Auditing page

The File System Auditing page displays when File System is selected from the Auditing task list in the navigation pane of the Administration Tasks tab. From this page you can launch the File System Auditing wizard to specify the file, folder or all drives in a system that are to be audited. You can also edit existing templates, disable a template, and remove templates that are no longer being used.

The File System Auditing page contains an expandable view of all the File System Auditing templates that have been previously defined. To add a new template to this list, click Add. Once added, the following information is provided for each template:

Click the expansion box to the left of the Template name to expand this view and display the following details for each template:

File System Auditing templates

To enable File System auditing in Change Auditor, you must first create a File System Auditing template which specifies the files, folders, or all drives on a system that are to be audited. This template must then be assigned to the appropriate agents’ configuration to audit the specified files and folders.

2
Click Auditing.
3
Select File System (under the Server heading in the Auditing task list) to open the File System Auditing page.
4
Click Add to open the File System Auditing wizard which will step you through the process of creating a File System Auditing template.
Template Name - Enter a name for the template.
Audit Path - Select the File option. Enter a file name (Drive:\Folder\FileName.ext) or click the browse button and select the file to be audited.
Click Add to move the specified file to the selection list.
Events tab - Select the file events to be audited for the file selected in the selection list.
NOTE: Selecting the File Events check box at the top of the events list on the Events tab will select all of the events listed. Similarly, clearing this check box will clear all of the selected events.
8
(Optional) Click Next to proceed to the next page to select processes that are to be excluded from auditing (for example, changes made by the processes specified on this page will not be audited).
Select one or more processes from the process list and click Add to move these processes to the exclusion list at the bottom of the page.
10
To create the template and assign it to an agent configuration, expand Finish and select Finish and Assign to Agent Configuration.
On the Agent Configuration page, select the agents assigned to use the modified agent configuration and click Refresh Configuration to ensure the agents are using the latest configuration.
2
Click Auditing.
3
Select File System (under the Server heading in the Auditing task list) to open the File System Auditing page.
4
Click Add to launch the File System Auditing Wizard which steps you through the process of creating a File System Auditing template.
Template Name - Enter a name for the template.
Audit Path - Select the Folder option. Enter a folder name (i.e., Drive:\Folder\) or click the Browse button to select the folder to audit.
NOTE: Once the Folder option is selected, you can select a system variable using the drop-down menu. Click the arrow to the far right of the text box and select one of the following options:
Click Add to add the specified folder to the Selection list (middle of the page).
6
By default, the scope of coverage for the selected folder will be This object and all child objects. However, you can change the scope, by selecting a different option from the drop-down box in the scope cell of the selection list:
This object only- select this option to audit only the selected folder, not its files or subfolders.
This object and child objects only - select this option to audit the selected folder and its direct files and subfolders. This is not recursive.
This object and all child objects - select this option to audit this folder and all of its files and subfolders.
NOTE: Selecting the File Events or Folder Events check box at the top of the events list on the Events tab will select all of the events listed. Similarly, clearing these check boxes will clear all of the selected events.
Once you have specified the subfolders/files for inclusion, click Add to add it to the Inclusion list at the bottom of the page.
For example, entering *.log will exclude all files in the audit folder with the .log file extension. Whereas, entering **.log will exclude all files with the .log file extension found in the audit folder or in any subfolders.
Browse Files - selecting this browse option displays the Select a file system path dialog allowing you to select a file for exclusion from auditing.
Browse Folders - selecting this browse option displays the Browse for Folder dialog allowing you to select a folder for exclusion from auditing.
Once you have specified a subfolder or file for exclusion, use the appropriate Add command to add it to the Exclusion list at the bottom of the page:
Add | Folder - use this option to exclude activity against files/subfolders in any folders that match the exclusion string.
Add | File - use this option to exclude activity against any files that match the exclusion string.
10
(Optional) Click Next to proceed to the next page to select processes that are to be excluded from auditing (for example, changes made by the processes specified on this page will not be audited).
From this page, select one or more processes from the process list and click Add to move these processes to the list at the bottom of the page.
12
To create the template and assign it to an agent configuration, expand Finish and select Finish and Assign to Agent Configuration.
On the Agent Configuration page, select the agent(s) assigned to use the modified agent configuration and click Refresh Configuration to ensure the agents are using the latest configuration.
2
Click Finish or expand the Finish and select Finish and Assign to Agent Configuration.

The disable feature allows you to temporarily stop auditing the specified file path without having to remove the auditing template or individual file path from a template.

Place your cursor in the Status cell for the template to be disabled, click the arrow control and select Disabled.
The entry in the Status column for the template will change to ‘Disabled’.
2
To re-enable the auditing template, use the Enable option in either the Status cell or right-click menu.
Place your cursor in the Status cell for the file path to be disabled, click the arrow control and select Disabled.
The entry in the Status column for the selected file path will change to ‘Disabled’.
2
To re-enable the auditing of a file path, use the Enable option in either the Status cell or right-click menu.

File System Auditing wizard

The File System Auditing wizard displays when you click Add or Edit on the File System Auditing page. This wizard steps you through the process of creating a new file system auditing template, identifying the files, folders or all drives on a system that are to be included in the auditing template.

The following table provides a description of the fields and controls in the File System Auditing wizard:

Use the first page of the wizard to enter a name for the template and specify the individual file or folder or all drives to be audited.

Template Name

Enter a descriptive name for the template being created.

Audit Path

Select one of the following options to define auditing for a file, folder or all drives:

File - select this option to audit a single file. Then enter a file name and path (i.e., Drive:\Folder\FileName.ext) or use the browse button to locate and select the file to be audited.
Folder - select this option to audit a folder or a set of files. To specify a particular folder, enter the folder’s name (for example, Drive:\Folder\) or use the browse button to select the folder to be audited.
All Drives - select this option to audit all drives. The Audit Path text box will contain an asterisk (*) which cannot be changed.

Once you have entered the audit path to be audited, use the Add button to add it to the selection list.

When the File or Folder option is selected as the audit path, click the browse button to locate and select a file or folder to be audited.

Add

Click Add to move the entry in the Audit Path text box to the selection list.

NOTE: Even though you cannot edit the Audit Path when the All Drives option is selected, you must still use Add to move it to the selection list.

Remove

Select an entry in the selection list and click Remove to remove it from the template.

Selection list

The list box, located across the middle of this page, displays the files, folders or All Drives selected for auditing.

When a Folder is selected, you can use the drop-down menu in the Scope field to change the scope of coverage for a folder:

This object only - select this option to audit only the selected folder, not its files or subfolders.
This object and child objects only - select this option to audit the selected folder and its direct files and subfolders. This is not recursive.
This object and all child objects - select this option to audit this folder and all of its files and subfolders. (Default)

Select an entry in this list to enable the corresponding Events, Inclusions and Exclusions tabs at the bottom of the page.

Use the Events tab to select the file and/or folder events to audit in the selected audited path. The contents of this tab are based on the entry selected above in the Selection list.

File Events

Select the file events to audit. Select the File Events check box to select all of the file events listed or select individual events from the list.

NOTE: Due to the potential of generating a very large number of events, File Open events are NOT captured when This object and all child objects is selected in the Scope cell. Therefore, File Open is NOT included in the File Events list on this page when This object and all child objects is selected above.

Folder Events

Select the folder events to audit. Select the Folder Events check box to select all of the folder events listed or select individual events from the list.

NOTE: Due to the potential of generating a very large number of events, Folder Open events are NOT captured when This object and all child objects is selected in the Scope cell. Therefore, Folder Open is NOT included in the Folder Events list on this page when This object and all child objects is selected above.

Ignore specific events

Multiple folder open events are generated by tooltips (folder content information that is displayed when you hover your mouse over a folder) because Windows Explorer navigates the folder tree for all the sub-folders when you hover over the parent folder to see the tooltip. To ignore the folder opened events generated by this action, select the Discard Windows Explorer tooltip events from browsing option.

Multiple file open events are generated by file scans because Windows Explorer opens and reads the header of all files contained in an opened folder for information to display in the window. To ignore the file open events generated by this action, select the Discard file open events from folder browsing option.

When the Folder or All Drives option is selected in the Audit Path field and the Scope includes child objects, the Inclusions tab will be displayed allowing you to specify what in the selected audit path is to be audited.

Add the names of subfolders and files to audit

Enter a file mask to specify what in the selected audit path is to be audited. The file mask can contain any combination of the following:

For example, entering * will include all folders and files in the selected audit path. See File/Folder Inclusion and Exclusion Examples for more file mask examples.

You can also enter the name of an individual subfolder or file to be included. However, if you enter the name of a subfolder, you will only receive events for operations performed against that subfolder. You will NOT receive any events for operations performed against any child objects under the specified subfolder.

Once you have specified the subfolder or file to be included, click Add to add it to the Inclusions list.

Inclusions list

The list across the bottom of this page contains the subfolders and files selected for auditing. Use the buttons to the right of the text box to add and remove entries.

Add - Click to move the entry in the text box to the Inclusions list.
Remove - Select an entry in the Inclusions list and click Remove to remove it.

When the Folder or All Drives option is selected in the Audit Path field and the Scope includes child objects, the Exclusions tab will be displayed allowing you to refine the settings defined on the Inclusions tab. That is, you can optionally specify the names and paths of any subfolders and files in the selected audit path that are to be excluded from auditing.

Add the names and paths of subfolders and files to exclude from auditing

Enter a file mask to specify the name and path of subfolders and files to be excluded from auditing. The file mask can contain any combination of the following:

For example, entering *.log will exclude all files in the audit folder with the .log file extension. Whereas, entering **.log will exclude all files with the .log file extension found in the audit folder or in any subfolders.

See File/Folder Inclusion and Exclusion Examples for more examples.

You can also enter the name of an individual subfolder or file to be excluded or use one of the browse options to browse for and select an individual subfolder or file.

Click the browse button and select one of the following options:

Browse Files - selecting this option displays the Select a file system path dialog allowing you to select an individual file for exclusion.
Browse Folders - selecting this option displays the Browse for Folder dialog allowing you to select an individual folder for exclusion.

Once you have specified a subfolder or file to be excluded, click the appropriate Add button to add the file or folder to the Exclusions list.

Exclusions list

The list across the bottom of this page contains the folders, files and masks that are to be excluded from auditing. Use the buttons to the right of the text box to add and remove entries.

Add | Folder - Use this to exclude activity against files/subfolders in any folders that match the exclusion string.
Add | File - Select this to exclude activity against any files that match the exclusion string.
Remove - Select an entry in the Exclusions list and click Remove to remove it.
(Optional) Select Processes Exempt From Auditing page: Use this page to suppress events generated by a specific process (e.g., anti virus process).

Processes list

Displays a list of the processes available on the local server. From this list, select one or more processes and click Add to move them to the Excluded Process list at the bottom of the page.

You are viewing processes on

Displays the name of the server from which the processes list was populated.

Click the browse button to select a different server. Selecting this button displays the Select Active Directory Objects dialog. Use the Browse or Search page to locate and select a server. The processes found on that server will then be displayed.

Enter a process not listed above

Select this check box to enter the name of a process that you do not find listed in the Processes list.

You can also enter a file mask to select a group of processes to be excluded from auditing. The file mask can contain any combination of the following:

Click the Add button to add the selected process(es) to the Excluded Process list.

Excluded Process list

The list across the bottom of the page lists the processes that will be allowed to make changes to audited object without generating an event. Use the buttons located above this list box to add and remove processes.

Add - Select one or more processes in the Processes list and click Add to add the processes to the list.
Remove - Select one or more processes in the Excluded Process list and click Remove to remove them from the exclusion list.

File System Event settings

From the Agent Configuration page on the Administration Tasks tab you can define how Change Auditor is to handle duplicate file system events.

Use the File System tab at the top of the Configuration Setup dialog to define how to process duplicate file system events.

2
Click Configuration.
3
Select Agent in the Configuration task list to display the Agent Configuration page.
4
Click Configurations.
7
Once you have set these settings, click OK to save your selections, close the dialog and return to the Agent Configuration page.
Related Documents