Tek-Tips is the largest IT community on the Internet today!
Members share and learn making Tek-Tips Forums the best source of peer-reviewed technical information on the Internet!
-
Congratulations strongm on being selected by the Tek-Tips community for having the most helpful posts in the forums last week. Way to Go!
Monitor for file existence/timestamp
- Thread starter lytus
- Start date
Robbman2000
Technical User
1. If you need to see if the file changes in 30 minutes...
The only way I can think of is to write a personalized script to check for the existance of the file and write a timestamp somewhere. Either as a variable in memory to a small text file. Run the script every 30 minutes. You will have to create another rule to trap the "script generated" alert to alert you.
If you want to monitor this file on all computer just add the Windows 2000 and 2003 Any computer group to the rule. If it is just a small set of server you will want to create a computer group.
2. If you want to see if any file is modified ANYTIME in a certain directory you can turn logging up on your server and monitor for event 560 in the security log. I have this setup to see if any files have changed in my scripts directory.
The rule would be:
Data Provider = Security
Criteria = (used the Advanced tab)
Event Number equals '560'
Description contains substring 'AddSubdirectory'
Source computer equal 'yourServer' (unless you want to use a computer group)
Parameter 3 contains substring '\SYSVOL\domain\scripts\'
The only way I can think of is to write a personalized script to check for the existance of the file and write a timestamp somewhere. Either as a variable in memory to a small text file. Run the script every 30 minutes. You will have to create another rule to trap the "script generated" alert to alert you.
If you want to monitor this file on all computer just add the Windows 2000 and 2003 Any computer group to the rule. If it is just a small set of server you will want to create a computer group.
2. If you want to see if any file is modified ANYTIME in a certain directory you can turn logging up on your server and monitor for event 560 in the security log. I have this setup to see if any files have changed in my scripts directory.
The rule would be:
Data Provider = Security
Criteria = (used the Advanced tab)
Event Number equals '560'
Description contains substring 'AddSubdirectory'
Source computer equal 'yourServer' (unless you want to use a computer group)
Parameter 3 contains substring '\SYSVOL\domain\scripts\'
- Status
Similar threads
- Locked
- Question
- Locked
- Question
- Locked
- Question
- Locked
- Question