Networks

Question

Gravatar
Locked

Logging daily DNS/Network Traffic - Windows Server 2008 R2

By linkos ·
Greetings,

my question is how I can achieve on Windows Server 2008 R2 that the DNS traffic on our network is monitored and logged on a daily basis.

I already did quite some research on the internet and found using the command-line tool "nmcap" with Windows Network Monitor to be a great solution.
Here's the batch I wrote which runs fine if I run it manually.

@ECHO OFF
set filename=%date:~6,4%_%date:~3,2%_%date:~0,2%_nwlog
nmcap /network * /capture "(IPv4.SourceAddress != 192.168.x.x AND Protocolname=='DNS')" /DisableConversations /StopWhen /Time 23:00:00 /file S:\NetworkLogs\%filename%.cap

First line after @ECHO OFF simply creates a date variable which is used later to name the file correctly, to have proper named logfiles on a daily basis.

I've set up a schedules task on the server, running the bat at 07:00am every day as SYSTEM, but I can't get it to work properly.

The main use is, as already stated, to have this batch running every day on the server in the background, running from 07:00-23:00 and saving the logfiles in my desired location.

I'd really appreciate some help regarding this :)

Thanks in advance!
-Boris

This conversation is currently closed to new comments.

1 total post (Page 1 of 1)  
Thread display: Collapse - | Expand +

All Answers

gravatar
Collapse -

Environment variables can be tricky to set sometimes

by robo_dev In reply to Logging daily DNS/Network ...

Try naming the filenames explicitly to see if that's where the fault is.

Also don't forget that spaces are not allowed in DOS filenames, so if the first part tries to create a cap file with a space in it, that wont work. So perhaps what's needed is "%filename%".cap

Back to Networks Forum
1 total post (Page 1 of 1)  

Start or search

Related Discussions

Related Forums