File share auditing

[DevilsAdvocate]

Hi all,

 

A member of staff asked me to restore a file that had been deleted by someone from our 'Common' share (accidentally or otherwise). They then asked whether I could tell them who it was who deleted the file. Since I knew I didn't have auditing enabled I said it wasn't possible. After looking into auditing and such I enabled it and subsequently saw the event log on the file server logging stuff almost every second! Is there anyway to specify that I only want it to log file deletions? What do other people do in regards to this? We are running Storage Server 2012 on this machine.

 

Thanks in advance.