I'm trying to get details of files modified and created in particular
directories via Events Viewer. I get it, but there's loads of other
events I don't want (and I don't want to use Event Viewer's filters)
eg loading the files. In User Manager> Audit Policy I've just checked
File and Object Access success to audit, and in the directory
properties >Audit I've just checked "Write" and Delete" in the events
to audit. I also use Dumpel to read the log (with appropriate
filters); if this surfeit of information is impossible to stop, how do
I discern the writes/deletes off the log? It brings back a real big
lot of information. . .

---

Request for Question Clarification by alienintelligence-ga on 03 Oct 2002 06:13 PDT

Hi owenwatson,

Would taking an export of the event viewer
items and importing them into something like
MS Access be too many steps? Or are you looking
for a software product solution that is all-in-one?

thanks,
-AI

---

Clarification of Question by owenwatson-ga on 03 Oct 2002 14:06 PDT

I'm already doing roughly that: I'm running dumpel and importing the
result into a database for analysis. I'm trying to (a) keep down the
event log size, and (b) trying to interpret the dumpel log to find out
what are the actual writes or deletes rather than just reads.