Article View: comp.os.ms-windows.nt.admin.networking
Article #65Setting up an ALERT when the security log reaches a certian size.
From: Simon
Date: Wed, 07 Feb 2001 11:23
Date: Wed, 07 Feb 2001 11:23
24 lines
2864 bytes
2864 bytes
HI guys, I would love your help on this one please. A folder needs to be audited for Read and Write events. A lot of files will be written to this folder. Ive set up auditing in UM4D (File and Object Access), and specified Success and Failure on these etc. Then I set up the auditing on the folder itself, and added the appropriate users and auditing levels per user/group. Due to the number of files that will be written, and possibly read, the default size of the security log of 512K is not large enough, so I monitored its growth for 2hours, and calculated that Id have to save the security log to file every 2 days, if I set its ceiling to 20MB. I set the log to manually clear events, and not to overwrite, as they want all events logged! The security log I know is saved as secevt.EVT in c:\winnt\system32\config folder. What I want to be able to do is instead of having to constantly monitor the size of the security log, and then manually save it to file, then clear out the log and start again, is to be ALERTED over the network, maybe through a net send message, that the file has reached a certain peak eg.15MB, so that I can then take the appropriate action of saving the log and clearing it out for future events. Ive looked in Performance Monitor, but I cant seem to find any objects that will be able to do this. Thank you
Technical Details
Message-ID:
<e6ag6.19601$65.96891@newsfeeds.bigpond.com>Path:
arc1-ca.pugleaf.net!supernews.google.com!sn-xit-02!supernews.com!news.tele.dk!195.25.12.36!oleane.net!oleane!codeine.org!intgwpad.nntp.telstra.net!newsfeeds.bigpond.com!not-for-mailShow Full Headers
Complete Article Headers
X-Google-Language: ENGLISH,ASCII-7-bit X-Google-Thread: fa2c1,293099f6ba9259,start X-Google-Attributes: gidfa2c1,public X-Google-Thread: 10de39,293099f6ba9259,start X-Google-Attributes: gid10de39,public X-Google-Thread: fb9cd,293099f6ba9259,start X-Google-Attributes: gidfb9cd,public X-Google-Thread: f977f,293099f6ba9259,start X-Google-Attributes: gidf977f,public X-Google-Thread: 115b46,293099f6ba9259,start X-Google-Attributes: gid115b46,public X-Google-ArrivalTime: 2001-02-07 03:26:36 PST Path: arc1-ca.pugleaf.net!supernews.google.com!sn-xit-02!supernews.com!news.tele.dk!195.25.12.36!oleane.net!oleane!codeine.org!intgwpad.nntp.telstra.net!newsfeeds.bigpond.com!not-for-mail Reply-To: "Simon" <simieh@bigpond.com> From: "Simon" <simieh@bigpond.com> Newsgroups: comp.os.ms-windows.nt.admin.networking,comp.os.ms-windows.nt.admin.security,comp.os.ms-windows.nt.misc,de.comp.os.ms-windows.nt,dk.edb.ms-windows.nt Subject: Setting up an ALERT when the security log reaches a certian size. Lines: 26 X-Priority: 3 X-MSMail-Priority: Normal X-Newsreader: Microsoft Outlook Express 5.00.2314.1300 X-MimeOLE: Produced By Microsoft MimeOLE V5.00.2314.1300 Message-ID: <e6ag6.19601$65.96891@newsfeeds.bigpond.com> Date: Wed, 7 Feb 2001 22:23:40 +1100 NNTP-Posting-Host: 203.54.57.90 X-Trace: newsfeeds.bigpond.com 981544458 203.54.57.90 (Wed, 07 Feb 2001 22:14:18 EST) NNTP-Posting-Date: Wed, 07 Feb 2001 22:14:18 EST Organization: Telstra BigPond Internet Services (http://www.bigpond.com)