Monitor all file system activity on a target server

Download source files - 14.9 Kb

Introduction

This file system watcher allows you to monitor all file system activity on a target server. This is particularly useful when you are working with an  architecture that requires complex configuration modifications. By  deploying this file system watcher you can keep a history of what  files are created, modified and deleted and when these events occurred. You can also determine if any automated build processes are occurring on the target machine by recognizing regular binary drops, etc.

This simple solution was brought to you by the Chatbot! Cyber Community where humans and chatbots unite!

• http://www.p2bconsortium.com/ - Person 2 Bot Consortium
• http://www.chatbot.us/ - Chatbot! Personal Chatbot Server

Instructions to deploy

Step 1

Build \FileSysWatch\FileSysWatch.sln

Step 2

Copy \setupFileSysWatch\Debug\Setup.Exe to target server

Step 3

Remote-Desktop into target server. On Windows 2000: Start->Programs-> Accessories->Communications->Terminal Service Client

Step 4

Create directory structure: C:\SimpleSolutions\_fso_lg\ on target server

Step 5

Install \setupFileSysWatch\Debug\Setup.exe on target server

Step 6

At command prompt on target server type "net start filesyswatch"

Step 7

Periodically look at log file in C:\SimpleSolutions\_fso_lg\ on target server

Step 8

"Disconnect" from remote server do not "log off" and your FileSysWatch process will continue to monitor file system activity when you are logged off.

Deployment Model

You must Sign In to use this message board.

FAQ    Noise Tolerance Very HighHighMediumLowVery Low   Layout Expand Posts & RepliesThread ViewNo JavascriptNo JS + Preview   Per page 102550

Msgs 1 to 12 of 12 (Total in Forum: 12) (Refresh) FirstPrevNext

My vote of 1 -midiman- 11:25 5 Dec '08   It's a rubbish article Sign In·View Thread·PermaLink How about monitoring network drives mpmalajos 22:23 19 Sep '07   i have a problem regarding monitoring an NAS storage system. it triggers no event or what so ever.. Sign In·View Thread·PermaLink 1.00/5 (1 vote) Excellent code nandumenon@hotmail.com 12:42 6 Sep '05   Thanks for posting this code. I was looking for a simple file monitor which does exactly the same. Sign In·View Thread·PermaLink 2.00/5 (1 vote) Monitor the Start Process Anonymous 12:21 21 May '05   Hi, you can help me in How detect when .exe file is Started and Get "Window Title Name" ?? Sign In·View Thread·PermaLink catch event before file opens krisst_k 4:53 14 May '05   How would i do to catch the event BEFORE the file opens? I would like it to be written in the log that a file is about to be opened. Sign In·View Thread·PermaLink 1.00/5 (1 vote) Nice article. Very to-the-point and no unnecessary verbosity. xlang 11:51 11 Dec '03   Nice article. Very to-the-point and no unnecessary verbosity. Why disconnect instead of log off? Sign In·View Thread·PermaLink 2.45/5 (5 votes) Re: Nice article. Very to-the-point and no unnecessary verbosity. DragonByte 9:50 25 Dec '03   because you don't log-off and you just disconnect...you aren't truly logged off of the server and all your apps, services, and windows are still running. Try to terminal service into a server...open a few windows and then just disconnect. Once you reconnect all your stuff is still running and open. Doing this keeps your file system watcher still running. The Dragon Sign In·View Thread·PermaLink 2.14/5 (3 votes) Article ? nvoigt 1:25 10 Dec '03   The project is a mess. 2 Files Visual Sutio generated, some lines added, zero lines cleaned up. No explanation of what is done there and why ( not that one would need any ). The FileSystemWatcher assumes there is only one partition and it's named C: Too many advertising space. Way to go, this needs a rework that probably takes more time than the original adticle. Sign In·View Thread·PermaLink 4.56/5 (5 votes) Question - why are _fso_lg, recycler, etc. filtered out of the file system activity? Eric James Johnson 13:24 9 Dec '03   if((e.Name.IndexOf("_fso_lg") == -1) && (e.Name.IndexOf("ntuser.dat") == -1) && (e.Name.IndexOf("mmc104.tmp") == -1) && (e.Name.IndexOf("winnt\\system32\\config\\software") == -1) && (e.Name.IndexOf("recycler") == -1) && (e.Name.IndexOf("\\recent") == -1) && (e.Name.IndexOf("log\\nmapserv.log") == -1) && (e.Name.IndexOf("scs12e.tmp") == -1)) { ..... log file system activity } Sign In·View Thread·PermaLink 3.67/5 (3 votes) Re: Question - why are _fso_lg, recycler, etc. filtered out of the file system activity? Anonymous 13:28 9 Dec '03   Good question. _fso_lg is the directory that stores the log file so monitoring it would create an infinite loop. The others are frequently accessed folders and files so they are filtered to clean up the data logged. Sign In·View Thread·PermaLink 2.33/5 (3 votes) yes, another fine example funny thing 13:06 9 Dec '03   of cpspam. It's an article alright but a reall fücked up one. Must have taken all of 30 seconds to create. Probably took longer going through the submission wizard than writing the article. This is an adverticle, nothing more. Now, piss off and write something useful retard. Try to make the article text useful, try not to make the page too wide and write to THINK .o0(am I uploading a pile of sh*t or a useful article) Oh yeah, and take a quick look at your profile information. You've done a great job of fücking that up too. Sign In·View Thread·PermaLink 4.12/5 (11 votes)

Last Visit: 17:50 8 Nov '09     Last Update: 17:50 8 Nov '09 1