How can I track who is saving large files to the network?

I need a way to monitor our network drives so that when someone saves a large amount of data to them we get either an alert or some sort of log that we can view. The key thing is that we need to know who has saved the data.
The problem that we are having is that we will have say 10GB left on one of the network shares. Someone will then try and save data to it totalling 12GB. When the drive runs out of space the user will realise its their data that has caused the problem and delete it.
We have monitoring software in place that alerts us when the drive space is running low (goes below 2 GB) but by the time we logon and search the drive the user has already deleted what they saved so we are unable to find out who it was.

If we need to buy software to do this that is fine but if there is another way that would be good.

Shared drives are on Windows Server 2003.
Client computers running a mix of Windows 2K and XP.

Who is Participating?
BillDLConnect With a Mentor Commented:

Just a thought.  If the program that creates the massive log files is able to export to ascii text, then maybe you could compile an "AutoIT3" script to *.exe file and schedule it to perform the following sequence at regular intervals:

1. Export the accumulated log to *.txt and then clear it (if that option exists)
2. Run a FIND command on the log file for instances of whatever alert is logged, and output the relevant lines to a much smaller analysis *.txt file
3. Delete that exported log file
5. email the user with an advisory note or set a logon notice for that user.

The bulk of the AutoIT script could be written using the wizard interface and going through each step live to generate the simulated keystroke call functions of the script as you go.

Here's an example tutorial:

Worth experimenting with, or too elaborate?
Have you looked at the Windows Server Event Logs to see whether the alert signalling the drive capacity issue give any more detail as to the origins of the process that caused the error situation?

Does your monitoring software have the option or capability of creating verbose enough logs to give that level of detail?
KronaxAuthor Commented:
I have looked into the event logs but could not find any alerts listed when the shared drive runs out of space.

Our current monitoring software is fairly basic and only monitors the amount of space available on the share. I have tried searching for other products but have been unable to find any that do anything other that monitor drive space, file types and file access. Most will not record the user who has made the change. I have found one that will but it records every change that happens on the drives so you end up with a massive log file. Unfortuantely it does not offer any option to filter it by size or any other usefull parameters.
Thank you Kronax
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.