filter security log

Thread view:

Enable EMail Alerts

Start New Thread

Thread rating:

inenewbl - 26 Sep 2007 04:44 GMT

Hi all. I would like to retrieve object access logs on a particular folder
from my security log as my security log contains too many other logs. I have
enabled auditing on that particular folder. Is there a way i can filter
according to object access logs on that particular folder using a script?
Thks in advance.

Reply to this Message

urkec - 26 Sep 2007 20:08 GMT

> Hi all. I would like to retrieve object access logs on a particular folder
> from my security log as my security log contains too many other logs. I have
> enabled auditing on that particular folder. Is there a way i can filter
> according to object access logs on that particular folder using a script?
> Thks in advance.

Maybe you could use WMI and Win32_NTLogEvent class to check if event
description contains name of the folder you are monitoring:

strComputer = "."

Set objWMIService = GetObject("winmgmts:" & _
"{impersonationLevel=impersonate," & _
"(Security)}!\\" & _
strComputer & "\root\cimv2")

Set colLoggedEvents = objWMIService.ExecQuery _
("Select * from Win32_NTLogEvent " & _
"Where Logfile = 'Security' " & _
"And Message Like '%C:\\MonitoredFolder%'")

For Each objEvent in colLoggedEvents

WScript.Echo objEvent.TimeGenerated
WScript.Echo objEvent.Message
WScript.Echo

Next

WScript.Echo "Done"

I haven't used this before so I'm not sure if it will work for you.
There is also a script named eventquery.vbs in my System32 folder (I'm using
Windows XP). Maybe you can find it useful.

Signature

urkec

Reply to this Message