Security

Ask something
Discussion Locked

File Access and Auditing Solution

0 helpful
9 replies

by erickdm

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
My company has a need to monitor all file copying and access of a specific folder on our server. We are in a NT4 Server and 98 workstation environment. The software monitoring solution must provide an alert notification and detailed activity report. I know that under either a pure NT / 2K shop or a mixed Netware / NT shop, LT AUDITOR+ from Blue Lance (www.bluelance.com) would be an acceptable solution. Any solutions would be greatly considered.

9 replies

by shmaltz

Whats wrong with NT's built in Auditing options?
The way I use it is, in event viewer I filter the records to just the file audits then I export them to a txt file then I import them in to a database (of course I had to do the programmin of importing it correctly, since the format of event viewers export is not good enough). I'm sure you can add some functions to your database thru API to do the filter and export thru the program. I use access to do the job for me.

by shmaltz

I even use the same thing to collect data about user that punch in but dont get to work at their computers for few more minutes (my CFO asked me to do this).

by insatiable

I've been evaluating a copy of RealSecure's host-based software that will monitor what you're talking about.
The software I'm evaluating is for a Unix system, but the manager that reads the reports is on NT.
It reads the auditing reports you use in NT and evaluates and detects trouble or what you set as a policy (report anyone reading that folder)

We use the RealSecure 5.5 as our IDS for our network. You actually get so much information from the sensors that you have to learn to filter out the "stuff" you don't want to see. That same manager/console that is used for the network IDS is used for the host-based monitoring.
I don't know if I'm explaining it well enough (forgive me, I've been on vacation for a week!), but I know the software will do what you want it to do because I can see that with the Unix eval copy I've been working with and also with the network version we run regularly.
You might want to check out their whole SafeSuite solution line, but here's the link to the Operating System Server:
http://www.iss.net/securing_e-business/security_products/intrusion_detection/realsecure_ossensor/index.php

Good luck!!

by erickdm

Your answer was a little more in tune with what I was looking for, however it is not capable of monitoring the client in question because of operating system.

This discussion is closed to new replies.