Network auditing software

[timbo343]

Is there, or is there not, a piece of software that sits on the file servers and tells you who has deleted files or looked and edited files?

We are getting to the point where we cant trust teachers any more with files as someone, and we dont know who deleted a rather important file, yes we did have a backup, but someone did a load of work on it monday and it was deleted monday afternoon.

 

T

[daveyboy]

I've just started looking at LT Auditor.........

 

Altman Technologies

[ajbritton]

You can configure Windows to do this, but only audit what you have to or you will kill the server performance and bury yourself in data!

[timbo343]

You can configure Windows to do this, but only audit what you have to or you will kill the server performance and bury yourself in data!

 

How do you do that then, i just want to monitor when people delete files

[Roger]

We use Undelete Server Edition here, allows quick restore and lists user name that deleted files, Server edition around £300, great for those times in between backups !! see here:

 

Undelete

[plexer]

I presume that is £300 per server you want to protect from file deletion?

 

Ben

[Roger]

Yes Ben, that is correct but we only use it on the server(s) hosting users home folders, the others do not require close control, normal backup suffices here.

Roger

[SpuffMonkey]

We use the built in Windows auditing combined with System Change Log

 

http://www.greyware.com/software/systemchangelog/

 

which puts all the info in a usable format - it really annoys those teachers who delete a few directories and then say "the network went funny"

[Ric_]

If you turn on Shadow Copy, at least you can get the files back

[CyberNerd]

The samba 'recycle' and 'audit ' VFS modules also provide this functionality

http://www.samba.org/samba/docs/man/Samba3-HOWTO/VFS.html