Solved

File audit

Posted on 2003-10-22
7
247 Views
Last Modified: 2013-12-28
I have been tasked at work to reduce the number of files that are used by the organisation, there are 40000+ files and I want to be able to log which ones are being used so that I can archive ones that are not used.
Is there any way of achieving this without using the built in auditing as I don't find this very usefull.
Ideally I want to be able to get the info into a database so that I can extract the info I need.

Any ideas how I could achieve this ??

many thanks
0
Comment
Question by:duckp
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 3
  • 3
7 Comments
 
LVL 86

Expert Comment

by:jkr
ID: 9602134
Use the Auditing mechanism of NT (you can enable that in the user manager) - so the OS itself will automatically create an event log file for you.
0
 

Author Comment

by:duckp
ID: 9602335
The NT auditing only seems to allow viewing using the event viewer, this is not very practical when tracking 40000+ files, I need to be able to get the results into a database so that I can analyse and extract the info that I need.
0
 
LVL 19

Accepted Solution

by:
Dexstar earned 125 total points
ID: 9602897
Using the NT Auditing mechanism is definitely the way to go.  The trick is just getting at the information.

While it is possible to access the EventLog programmatically and get the information you need, I would take advantage of the "Export" feature of the EventLog viewer.

1) Open the Computer Management console.
2) Right-click on the "Security" section under "Event Viewer".
3) Select "Export List"
4) Then clear the log.

Then import that list into a database, and analyze the data anyway that you need.

Enjoy.
Dex*
0
SharePoint Admin?

Enable Your Employees To Focus On The Core With Intuitive Onscreen Guidance That is With You At The Moment of Need.

 
LVL 86

Expert Comment

by:jkr
ID: 9603671
>>The NT auditing only seems to allow viewing using the event viewer

Yes, but what is problem with dumping an event log to a file? :o)

http://www.sysinternals.com/ntw2k/freeware/psloglist.shtml
0
 

Author Comment

by:duckp
ID: 9608104
Thanks Dexstar.....I must be half asleep as I have used the export in the past....I think my brain is fried :-)

Thanks again
0
 
LVL 86

Expert Comment

by:jkr
ID: 9608125
Um, didn't I point aut the auditing mechanism or was this a Q about how to export an event log?
0
 

Author Comment

by:duckp
ID: 9608191
jkr as mentioned in my original question I already knew about the built in auditing and mentioned wanting to be able to use a database to extract the info I required, Dexstar reminded me about the export facility and the fact I would be able to import that output into a database.

Thanks for your input to the question but I felt Dexstar had a better idea what I was trying to achieve and gave the best answer to help me achieve my goal.
0

Featured Post

Free Tool: ZipGrep

ZipGrep is a utility that can list and search zip (.war, .ear, .jar, etc) archives for text patterns, without the need to extract the archive's contents.

One of a set of tools we're offering as a way to say thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

When you try to extract and to view the contents of a Microsoft Update Standalone Package (MSU) for Windows Vista, you cannot extract the files from the MSU. Here we are going to explain how to extract those hotfix details without using any third pa…
While rebooting windows server 2003 server , it's showing "active directory rebuilding indices please wait" at startup. It took a little while for this process to complete and once we logged on not all the services were started so another reboot is …
With the advent of Windows 10, Microsoft is pushing a Get Windows 10 icon into the notification area (system tray) of qualifying computers. There are many reasons for wanting to remove this icon. This two-part Experts Exchange video Micro Tutorial s…
This is used to tweak the memory usage for your computer, it is used for servers more so than workstations but just be careful editing registry settings as it may cause irreversible results. I hold no responsibility for anything you do to the regist…

737 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question