0

Is it possible to log file system events like copy, modification, deletion and creation of files and folders on a workstation? I primarily use Windows, but I would like to know if this is possible in Linux too. If no such functionality is built-in, is there a commercial product that can offer this functionality?

This is what I would like the log file to include.

Date         Time    User      Action   Type    Source                   Destination
2013-03-12   15:10   Austin    Copy     File    K:\Alabama\Mobile.txt    L:\Mobile.txt
2013-04-15   09:12   Bradley   Create   Folder                           C:\Chicago
2013-04-23   13:45   Cedric    Delete   Folder  G:\Colorado
2013-05-04   16:03   David     Modify   File    D:\Florida\Miami.txt

It might not look exactly like this, but something similar. I would like to know who did what, at what time, where, and to what folder or file. This is a seemingly very simple log but it would be very useful.

Update

The solution suggested in the linked question above says that one should use Group Policy in Microsoft Management Console to enable audit of objects, and then Event Viewer to view the logs.

I enabled audit for my own username on Desktop folder and tried creating a text file. Within the same second that the file was created, it 39 new events were produced in the log! I looked at the clock when I created the file and then filtered the log for events created on that exact second. I then had to look through them one by one to find the event that clearly states the file path and name.

When I tried deleting the file (permanent, not recycling to bin), on that same second 210 events were logged. Who the hell wants to go through all the events to find the right one? To find the exact event I would have to know beforehand that a certain even has occurred. Which makes the whole purpose of this useless. And I would need to know something about the even, i.e. the name of file created or something and try filter that. There are 28000 events stored in the Security log.

For this reason I don't think this is the solution to the problem. Well, it's not a intelligent one anyway. It would be much easier to use a dedicated tool for this. The Security log in Windows logs all kinds of security related events that are completely uninteresting to me.

2

1 Answer 1

4

Sounds like a job for Process Monitor on Windows, and inotifywait on Linux

Examples:

Here's a screenshot of Process Monitor in action

And here's inotifywait watching for changes to a particular subdirectory:

$ inotifywait -m /tmp/stuffthings/
Setting up watches.  
Watches established.
/tmp/stuffthings/ OPEN,ISDIR 
/tmp/stuffthings/ CLOSE_NOWRITE,CLOSE,ISDIR 
/tmp/stuffthings/ CREATE file.txt
/tmp/stuffthings/ OPEN file.txt
/tmp/stuffthings/ MODIFY file.txt
/tmp/stuffthings/ CLOSE_WRITE,CLOSE file.txt

You can install inotifywait and related programs on Ubuntu like so:

sudo apt-get install inotify-tools
2
  • Alright, I will look into these. Can you tell me if these tools are pure monitoring tools, or if they also have logging functionality? I mean I don't want to have them running in the foreground at all times. I just want them to produce logs of maybe the last 1000 file and folder events and have them saved to a pre-defined location.
    – Samir
    Jun 20, 2013 at 21:05
  • inotifywait is infinitely customizable, you could probably write a shell script to make it track just about anything, and with a little help from your stackexchange friends, rotate the logs. I haven't used Process Monitor as much, perhaps some Windows admins or desktop support folks could offer more insight? Jun 20, 2013 at 22:31

Not the answer you're looking for? Browse other questions tagged .