 |
 |
File System Auditing wizard
The File System Auditing wizard displays when you click Add or Edit on the File System Auditing page. This wizard steps you through the process of creating a new file system auditing template, identifying the files, folders or all drives on a system that are to be included in the auditing template.
Table 2. File System Auditing wizard
Select one of the following options to define auditing for a file, folder or all drives:
Once you have entered the audit path to be audited, use the Add button to add it to the selection list.
When the File or Folder option is selected as the audit path, click the browse button to locate and select a file or folder to be audited.
Click Add to move the entry in the Audit Path text box to the selection list.
NOTE: Even though you cannot edit the Audit Path when the All Drives option is selected, you must still use Add to move it to the selection list.Select an entry in the selection list and click Remove to remove it from the template.
When a Folder is selected, you can use the drop-down menu in the Scope field to change the scope of coverage for a folder:
Select the file events to audit. Select the File Events check box to select all of the file events listed or select individual events from the list.
NOTE: Due to the potential of generating a very large number of events, File Open events are NOT captured when This object and all child objects is selected in the Scope cell. Therefore, File Open is NOT included in the File Events list on this page when This object and all child objects is selected above.Select the folder events to audit. Select the Folder Events check box to select all of the folder events listed or select individual events from the list.
NOTE: Due to the potential of generating a very large number of events, Folder Open events are NOT captured when This object and all child objects is selected in the Scope cell. Therefore, Folder Open is NOT included in the Folder Events list on this page when This object and all child objects is selected above.Multiple folder open events are generated by tooltips (folder content information that is displayed when you hover your mouse over a folder) because Windows Explorer navigates the folder tree for all the sub-folders when you hover over the parent folder to see the tooltip. To ignore the folder opened events generated by this action, select the Discard Windows Explorer tooltip events from browsing option.
Multiple file open events are generated by file scans because Windows Explorer opens and reads the header of all files contained in an opened folder for information to display in the window. To ignore the file open events generated by this action, select the Discard file open events from folder browsing option.
When the Folder or All Drives option is selected in the Audit Path field and the Scope includes child objects, the Inclusions tab will be displayed allowing you to specify what in the selected audit path is to be audited.
For example, entering * will include all folders and files in the selected audit path. See File/Folder Inclusion and Exclusion Examples for more file mask examples.
Once you have specified the subfolder or file to be included, click Add to add it to the Inclusions list.
When the Folder or All Drives option is selected in the Audit Path field and the Scope includes child objects, the Exclusions tab will be displayed allowing you to refine the settings defined on the Inclusions tab. That is, you can optionally specify the names and paths of any subfolders and files in the selected audit path that are to be excluded from auditing.
Add the names and paths of subfolders and files to exclude from auditing
For example, entering *.log will exclude all files in the audit folder with the .log file extension. Whereas, entering **.log will exclude all files with the .log file extension found in the audit folder or in any subfolders.
See File/Folder Inclusion and Exclusion Examples for more examples.
Click the browse button and select one of the following options:
Once you have specified a subfolder or file to be excluded, click the appropriate Add button to add the file or folder to the Exclusions list.
(Optional) Select Processes Exempt From Auditing page: Use this page to suppress events generated by a specific process (e.g., anti virus process).
Displays a list of the processes available on the local server. From this list, select one or more processes and click Add to move them to the Excluded Process list at the bottom of the page.
Displays the name of the server from which the processes list was populated.
Click the Add button to add the selected process(es) to the Excluded Process list.
| |
|
File System Event settings
Discard duplicates that occur within nn seconds Audit all configured, including duplicates (Not Recommended) To set the File System Event settings:
| |
|
File System event logging
In addition to real-time event auditing, you can enable event logging to capture Windows file server events locally in a Windows event log. This event log can then be collected using InTrust to satisfy long-term storage requirements.
For Windows file server events, event logging is disabled by default. When enabled, only configured activities are sent to the Quest File Access event log. See the Change Auditor for Windows File Servers Event Reference Guide for a list of the events that can be sent to this event log.
To enable Windows file server event logging:
| |
|
File System Searches/Reports
