Re: Auditing folders

Agreed. And also, I'm not sure of the value of auditing successful file
reads for all files. Those are going to fill up your logs, and are you ever
going to use that information? I would use the Microsoft suggested auditing
levels in their Windows Server 2003 Security guide at
www.microsoft.com/technet/security [I think it mentions file auditing, I
can't remember.] If you feel you really must have more auditing than that,
you could consider syslogging your event logs to a syslog server that you
can query, using something like SNARE or NTSYSLOG.


"Roger Abell [MVP]" <mvpNoSpam@xxxxxxx> wrote in message
news:ObDgCzWBGHA.3928@xxxxxxxxxxxxxxxxxxxxxxx
> When you configure auditing you state what type of access and
> by what principals. If you audit for a custom group that only
> includes the accounts that you do want to generate audit records
> then you would have what you are after.
>
> "troyboy" <troyboy@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
> news:E76F9D54-5F25-4A51-BC3F-A861065E9264@xxxxxxxxxxxxxxxx
>> Good morning everyone,
>> I audit all of our folders using the built in feature in Server 2003. The
>> problem is our event log files are huge by the end of the day because
>> when
>> Veritas runs the backup at night it logs every file it reads and opens in
>> the
>> event log. Does anyone know of a way to exclude programs or users from
>> the
>> auditing process?
>> Thank you for your time.
>>
>
>


.

Relevant Pages

  • Re: Too much auditing?
    ... Just like any security setting, it is typically unproductive to just pick ... You need to examine the capabilities of audit, ... If you log everything, set your logs to a much larger size, such as 64MB ... Failure auditing is not useful for most people, ...
    (microsoft.public.win2000.security)
  • Re: Can you audit file access within Sharepoint Services 3.0?
    ... server instead of WSS and enable security audting on the file server if we ... tools from Quest Software or AvePoint allows you to view those logs but I ... an interface to turn on/off auditing; ... view the audit records so you'd have to build that as well. ...
    (microsoft.public.sharepoint.windowsservices)
  • Re: Auditing folders
    ... As we agree about the useof excessive audit trails ... I'm not sure of the value of auditing successful file ... you could consider syslogging your event logs to a syslog server ... >>> problem is our event log files are huge by the end of the day because ...
    (microsoft.public.security)
  • Re: Auditing in Sharepoint
    ... You can also get a certain amount of auditing by turning on your IIS logging ... You can audit many functions from IIS logs ... > audit Sharepoint or has Microsoft any plans to provide auditing facilities ...
    (microsoft.public.sharepoint.portalserver)
  • Re: Can you audit file access within Sharepoint Services 3.0?
    ... you can't enable it with Windows Explorer nor can you enable it with any out of the box stsadm command. ... Maybe one of the SharePoint-specific management tools from Quest Software or AvePoint allows you to view those logs but I haven't checked. ... an interface to turn on/off auditing; ... view the audit records so you'd have to build that as well. ...
    (microsoft.public.sharepoint.windowsservices)