Hey

I am on a project to centralise several geographically dispersed file
servers, and I need to collect some stats on file usage/activity at these
sites. I need to know how often documents/files on these servers are opened,
and how often documents (new or pre-existing) are saved, so that I can make
some estimates of the bandwidth that these site servers will consume if
centralised.

I have been playing with turning on Auditing for the relevant folders, which
logs events to the Security Log. While I think I can collect stats relating
to documents being opened using these logs, getting to the stats about
documents/files being saved or updated is more problematic as the events
thrown in these cases don't appear to offer the sort of data that I need. For
example, after turning on the "Create Files/Write Data" Auditing category, I
can look for 560 events for specific files, but each save generates numerous
events. There doesn't appear to be one "I am saving file x" event.

So, I am looking for:

- advice on how to best use the above Auditing events; and

- advice on other software solutions that would help me collect the stats.

Thanks

Alec

"vtr_ajr" <vtrajr@discussions.microsoft.com> wrote in message
news:A9796A96-15B6-4C1B-9D16-AC1A5D0E86B3@microsoft.com...
Right, they actually record the act of OPENING the file with the specified
PERMISSIONS, not whether the permissions capabilties are actually
used (open for read usually means it was read, but open for Read/Write
and the file might be closed with no changes.)

Correct.

For intentions. Probably when a user opens a Word Doc they
will modify it a high percentage of the time IF they have used
Write, but that is uncertain.

It would be more certain if only the owner (and others who change
the file) have Write etc and those merely "looking" at other peoples
file ONLY have READ etc.

A programmer could write a fairly simple logging app to monitor
"file change" and log the file names to a file or custom even log.

This would likely work most efficiently off the "file change notification"
of the NTFS directories (file system).

It's non-trivial but not particularly difficult.

--
Herb Martin, MCSE, MVP
http://www.LearnQuick.Com
(phone on web site)