Monitor system for virus files

I would like to monitor my server to see who is writing virus files, for example those ending in EML. Is there a way to log when a file type was written on which PC it came from?

tks for your help