Auditing Access file & LogParser

Hi everyone,
I'm running a w2k3 and I need to audit success on files on a specific folder ... I activated auditing for the everyone group on this folder, and started to watch my logs ...
I want to know exactly what user are doing with this files ( if they are opening, or working )... After some researches, it seems that 2k3 cant tell exactly what people are doing ... but 2K8 can ...
I understand how the 560 Event ID works. Dont seem to be very accurate ... here are my doubts !
Can you tell me if I'm right or not ?!
I check the handle ID too... but it seems to be linked with the application that opens a file ... or not ... or randomly generated .. couldn't find any answer for this question of mine !
Well, that's it !
thanks all !

Hi,
Based on my test, Windows 2k3 records exactly what people are doing. Please refer to the following Windows 2k3 record.
If you didn’t get this event, it may because policy "Computer Configuration\Windows Settings\Security Settings\Local Policies\Audit Policy\Audit object access" was not configured. Enable this policy and test.
For your reference:
Audit object access
http://technet.microsoft.com/en-us/library/cc776774(WS.10).aspx
Event Type:    Success Audit
Event Source:    Security
Event Category:    Object Access
Event ID:    560
Date:        6/1/2009
Time:        4:40:10 PM
User:        GT\administrator
Computer:    GTDC02
Description:
Object Open:
     Object Server:    Security
     Object Type:    File
     Object Name:    C:\newsid
     Handle ID:    1268
     Operation ID:    {0,8119592}
     Process ID:    2468
     Image File Name:    C:\WINDOWS\explorer.exe
     Primary User Name:    administrator
     Primary Domain:    GT
     Primary Logon ID:    (0x0,0xA0674)
     Client User Name:    -
     Client Domain:    -
     Client Logon ID:    -
     Accesses:    SYNCHRONIZE
            ReadData (or ListDirectory)
     Privileges:    -
     Restricted Sid Count:    0
     Access Mask:    0x100001
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Thanks.
This posting is provided "AS IS" with no warranties, and confers no rights.

Similar Messages

Mac OS X : ORA-09925: Unable to create audit trail file

I have followed the instuctions on Oracle's site:
http://www.oracle.com/technology/tech/macos/index.html
specifically the Blog pages by Sergio and Anthony and have encountered a couple problems:
1) I got this error when running the db config assitant (dbca) as per Anthony's steps:
ORA-09925: Unable to create audit trail file
I was running this from a shell while logged onto the gui as my admin id (mtaylor) then running
sudo -u oracle sh
then running the ./bash_profile commands, altho I had to
cd /Users/oracle
cat .bash_profile
and then copy and paste the commands since running
./.bash_profile
and then testing by running
echo $ORACLE_HOME
gave me a blank line.
I thought that logging onto the gui as mtaylor might be the problem since I was getting 2 errors in the shell as the java initialized:
ATSFontGetFileSpecification failed: error -5000 (twice),
2) so I decided to log onto the gui as the user oracle and then open a shell. Doing this, I get to step 12 of 12, press finish and nothing happens at all. It doesn't freeze tho because I can cancel and exit with no problem.
I went back to mtaylor and tried again and now I get the same result. I may have done something else to fix my first problem meanwhile as I have been working on this for a few hours.
I have confirmed that I am specifying the correct directories in the dbca, the .bash_profile and the files below, and that the owner:group is oracle:oinstall with r/w access:
ORACLE_BASE=/Volumes/u01/app/oracle
ORACLE_HOME="$ORACLE_BASE/product/10.1.0.3/db_1"
PATH="$PATH:~bin:$ORACLE_HOME/bin"
ORACLE_SID=orcl
My tnsnames.ora is (after default entry):
orcl.world =
(DESCRIPTION =
(ADDRESS=(PROTOCOL=TCP)
(HOST=localhost)(PORT=1521))
(CONNECT_DATA=(SERVER=DEDICATED)(SERVICE_NAME=orcl)))
My listener.ora is:
SID_LIST_LISTENER=
(SID_LIST=
(SID_DESC=
(SID_NAME=orcl)
(ORACLE_HOME=/Volumes/u01/app/oracle/product/10.1.0.3/db_1)))
I am specifying /Volumes/u02/oradata as the datafiles location (this exists with the same permissions as above)and specifying include the example schemas.
Any ideas anyone?
Matt

Problem solved.
See
10g install Mac OS X (Tiger) - ALMOST

Bad date recorded by AccessServer in Audit Log File

Hi all,
I have installed OAM and configure Audit Log File to AccessServer:
Access System Configuration >> Access Server Configuration >> and put ON "Audit to File"
The log is recorded OK, but when compare the date writed in log file with SO date, there are 6hs of diference
LOG FILE
01\/28\/2009 *00:18:07* \-0500 - AUTHZ_SUCCESS - GET - AccessServer - 192.168.3.105 - sec.biosnettcs.com\/access\/oblix\/lang\/en\-us\/msgctlg.js - cn=orcladmin\,cn=Users\,dc=biosnettcs\,dc=com - 00:18:07 - http - AccessGate - - 2
SO date
# date
mar ene 27 *18:18:15 CST* 2009
# date -u
miÃ© ene 28 *00:18:23 UTC* 2009
How we can see in this lines the audit log is recording date in UTC, but a need this in the timezone setted in SO.
How can do this (print date in audit log file with the same timezone setted by SO)??
Thaks in advance,
Julio

I response myself.
There is no way to set the Date/Time format to any other than UTC for the OAM component logs
See note 742777.1 for deeph information.
Julio.

How can I audit specific file??

I have some important files used by more than one user and i want to audit only these files ( removing or renameing events ... )
Can any body tel me how to do it on solaris 8?

As you know, auditting is usually done on a system basis which is selected when the Basic Security Model (BSM) is initialized (example: /etc/security/bsmconv /). In your case, the solution may be to modify the audit_user files to track the users who may be accessing the files in question. Still, this will not give you exactly the behavior that you want. You could always post-process the audit.log files a priori.

How to audit SQLJ files

Is it possible in JDeveloper 10.1.3.0.4 to audit SQLJ file without getting a lot of error messages like
Import 'sqlj.runtime.*' not used
and
Type 'AppSystemIterator' not found ?
Apparently audit looks at SQLJ source file and not at generated Java code. I guess that I could point it at generated code myself but it is inconvenient as it is not really a part of project.

Thank you very much Andres,
I followed your article and it works now, I can see event id 4663 in Security logs.
Can I configure it to log only event id 4663 ? It still log events like :
Event id 4656
A handle to an object was requested.
Subject:
Security ID: SYSTEM
Account Name: FILESERVER$
Account Domain: ITL
Logon ID: 0x3e7
Object:
Object Server: PlugPlayManager
Object Type: Security
Object Name: PlugPlaySecurityObject
Handle ID: 0x0
Process Information:
Process ID: 0x2ec
Process Name: C:\Windows\System32\svchost.exe
Access Request Information:
Transaction ID: {00000000-0000-0000-0000-000000000000}
Accesses: Unknown specific access (bit 1)
Access Reasons: -
Access Mask: 0x2
Event id 5140
A network share object was accessed.
Subject:
Security ID: MyDomain\user1
Account Name: user1
Account Domain: MyDomain
Logon ID: 0x1d786cf5
Network Information:
Object Type: File
Source Address: 192.168.12.139
Source Port: 49211
Share Information:
Share Name: \\*\IPC$
Share Path:
Access Request Information:
Access Mask: 0x1
Accesses: ReadData (or ListDirectory)
Event id 5145
A network share object was checked to see whether client can be granted desired access.
Subject:
Security ID: MyDomain\user2
Account Name: user2
Account Domain: MyDomain
Logon ID: 0x1d87ae60
Network Information:
Object Type: File
Source Address: 192.168.11.199
Source Port: 50696
Share Information:
Share Name: \\*\MAR
Share Path: \??\D:\Share\MAR
Relative Target Name: \
Access Request Information:
Access Mask: 0x80
Accesses: ReadAttributes
Access Check Results:
ReadAttributes: Granted by D:(A;;0x1301bf;;;S-1-5-21-2254521154-3912369078-372980068-1630)

How can multiple users edit and access same ACCESS file

Hello,
We have 2 access files and multiple users needs to edit and access those files.
How can I enable mulitple access but only one user can edit rest of users are in read-only mode for one file and multiple access and edit on the another file.

Hi,
You should split your database in a front and backend. Then create two seperate front ends which you can distribute. If you need readonly you can opt for two options, setting the attributes of the file to read only or create a front end with read only forms.
The last one takes a little more work but is safer than setting the attributes to read only because people can change that back themselfs.
Maurice

Can not get access files from Windows 7 to Claims-based file authorization share

We have AD level 2012R2, DCs running 2012R2 of course, and we have clustered File Server (3 FSNodes running 2012R2).
We enabled 2 policies
KDC Support for claim
Kerberos support for claim
We created 1 claim type in ADAC (For example "Division" Source Property). Filled this property to all IT AD Accounts by our value "IT"
On FS made a share folder ITDivision:
- set permissions Domain Users can Modify if User.Division equals "IT"
so on Windows 8 IT Users can access files on this share and on Windows 7 they cant
=\ . We know from many presentations about Dynamic Access Control that File Server must enroll user claims if client do not support this claims (Service-for-User-To-Self)

Hi,
>>so on Windows 8 IT Users can access files on this share and on Windows 7 they cant
=\ . We know from many presentations about Dynamic Access Control that File Server must enroll user claims if client do not support this claims (Service-for-User-To-Self)
How is it going? Was there any error message? As far as I know, Dynamic Access Control (DAC) should work for downlevel clients. It’s backwards compatible. As Florain explains in the following blog:
For non-Windows 8 and non-Windows Server 2012 boxes accessing DAC-protected file shares, the users do not carry any claims. For them, the Server 2012-based file share will query Active Directory and proxy the claims request to figure out what claims
the user and machine bring. The file server checks in the name of the user, whether they should have claims. With that information, the file server evaluates the access to the file share. So yeah – DAC works for downlevel clients, too. It’s backwards compatible.
And totally transparent to Windows 7.
Questions regarding Dynamic Access Control (FAQ)
http://www.frickelsoft.net/blog/?p=293
In addition, regarding dynamic access control, the following blog can also be referred to for more information.
Dynamic Access Control in Windows Server 2012
http://www.infoq.com/news/2012/10/Dynamic-Access-Control
Please Note: Since the above two website are not hosted by Microsoft, the link may change without notice. Microsoft does not guarantee the accuracy of this information.
Best regards,
Frank Shen

How can I access files from a flash drive that were previously saved using a Windows computer? When I attempt to open the file on MacBook Pro, it is asking to "convert file to"; I also have Microsoft Word installed on the Mac as well.

How can I access files from a flash drive that were previously saved using a Windows computer? When I attempt to open the file on MacBook Pro, it is asking to "convert file to"; none of the options I choose work. I also have Microsoft Office (with Word) installed on the Mac as well.

Format the external drive as FAT32 or ExFAT. Both computers will then be able to read and write to it.

Cannot access file from JApplet

I have used the swingall.jar file with my JApplet for any
version of IE. It gives one error
i.e
Cannot access file c:\prog\project
I want to create a directory within c:\prog and also i want
to write some files there. Pls help me.

try this my friend!
1.     Compile the applet
2.     Create a JAR file
3.     Generate Keys
4.     Sign the JAR file
5.     Export the Public Key Certificate
6.     Import the Certificate as a Trusted Certificate
7.     Create the policy file
8.     Run the applet
Susan
Susan bundles the applet executable in a JAR file, signs the JAR file, and exports the public key certificate.
1.     Compile the Applet
In her working directory, Susan uses the javac command to compile the SignedAppletDemo.java class. The output from the javac command is the SignedAppletDemo.class.
javac SignedAppletDemo.java
2.     Make a JAR File
Susan then makes the compiled SignedAppletDemo.class file into a JAR file. The -cvf option to the jar command creates a new archive (c), using verbose mode (v), and specifies the archive file name (f). The archive file name is SignedApplet.jar.
jar cvf SignedApplet.jar SignedAppletDemo.class
3.     Generate Keys
Susan creates a keystore database named susanstore that has an entry for a newly generated public and private key pair with the public key in a certificate. A JAR file is signed with the private key of the creator of the JAR file and the signature is verified by the recipient of the JAR file with the public key in the pair. The certificate is a statement from the owner of the private key that the public key in the pair has a particular value so the person using the public key can be assured the public key is authentic. Public and private keys must already exist in the keystore database before jarsigner can be used to sign or verify the signature on a JAR file.
In her working directory, Susan creates a keystore database and generates the keys:
keytool -genkey -alias signFiles -keystore susanstore -keypass kpi135 -dname "cn=jones" -storepass ab987c
This keytool -genkey command invocation generates a key pair that is identified by the alias signFiles. Subsequent keytool command invocations use this alias and the key password (-keypass kpi135) to access the private key in the generated pair.
The generated key pair is stored in a keystore database called susanstore (-keystore susanstore) in the current directory, and accessed with the susanstore password (-storepass ab987c).
The -dname "cn=jones" option specifies an X.500 Distinguished Name with a commonName (cn) value. X.500 Distinguished Names identify entities for X.509 certificates.
You can view all keytool options and parameters by typing:
keytool -help
4.     Sign the JAR File
JAR Signer is a command line tool for signing and verifying the signature on JAR files. In her working directory, Susan uses jarsigner to make a signed copy of the SignedApplet.jar file.
jarsigner -keystore susanstore -storepass ab987c -keypass kpi135 -signedjar SSignedApplet.jar SignedApplet.jar signFiles
The -storepass ab987c and -keystore susanstore options specify the keystore database and password where the private key for signing the JAR file is stored. The -keypass kpi135 option is the password to the private key, SSignedApplet.jar is the name of the signed JAR file, and signFiles is the alias to the private key. jarsigner extracts the certificate from the keystore whose entry is signFiles and attaches it to the generated signature of the signed JAR file.
5.     Export the Public Key Certificate
The public key certificate is sent with the JAR file to the whoever is going to use the applet. That person uses the certificate to authenticate the signature on the JAR file. To send a certificate, you have to first export it.
The -storepass ab987c and -keystore susanstore options specify the keystore database and password where the private key for signing the JAR file is stored. The -keypass kpi135 option is the password to the private key, SSignedApplet.jar is the name of the signed JAR file, and signFiles is the alias to the private key. jarsigner extracts the certificate from the keystore whose entry is signFiles and attaches it to the generated signature of the signed JAR file.
5: Export the Public Key Certificate
The public key certificate is sent with the JAR file to the whoever is going to use the applet. That person uses the certificate to authenticate the signature on the JAR file. To send a certificate, you have to first export it.
In her working directory, Susan uses keytool to copy the certificate from susanstore to a file named SusanJones.cer as follows:
keytool -export -keystore susanstore -storepass ab987c -alias signFiles -file SusanJones.cer
Ray
Ray receives the JAR file from Susan, imports the certificate, creates a policy file granting the applet access, and runs the applet.
6.     Import Certificate as a Trusted Certificate
Ray has received SSignedApplet.jar and SusanJones.cer from Susan. He puts them in his home directory. Ray must now create a keystore database (raystore) and import the certificate into it. Ray uses keytool in his home directory /home/ray to import the certificate:
keytool -import -alias susan -file SusanJones.cer -keystore raystore -storepass abcdefgh
7.     Create the Policy File
The policy file grants the SSignedApplet.jar file signed by the alias susan permission to create newfile (and no other file) in the user's home directory.
Ray creates the policy file in his home directory using either policytool or an ASCII editor.
keystore "/home/ray/raystore";
// A sample policy file that lets a JavaTM program
// create newfile in user's home directory
// Satya N Dodda
grant SignedBy "susan"
     permission java.security.AllPermission;
8.     Run the Applet in Applet Viewer
Applet Viewer connects to the HTML documents and resources specified in the call to appletviewer, and displays the applet in its own window. To run the example, Ray copies the signed JAR file and HTML file to /home/aURL/public_html and invokes Applet viewer from his home directory as follows:
Html code :
</body>
</html>
<OBJECT classid="clsid:8AD9C840-044E-11D1-B3E9-00805F499D93"
width="600" height="400" align="middle"
codebase="http://java.sun.com/products/plugin/1.3/jinstall-13-win32.cab#Version=1,3,1,2">
<PARAM NAME="code" VALUE="SignedAppletDemo.class">
<PARAM NAME="archive" VALUE="SSignedApplet.jar">
<PARAM NAME="type" VALUE="application/x-java-applet;version=1.3">
</OBJECT>
</body>
</html>
appletviewer -J-Djava.security.policy=Write.jp
http://aURL.com/SignedApplet.html
Note: Type everything on one line and put a space after Write.jp
The -J-Djava.security.policy=Write.jp option tells Applet Viewer to run the applet referenced in the SignedApplet.html file with the Write.jp policy file.
Note: The Policy file can be stored on a server and specified in the appletviewer invocation as a URL.
9.     Run the Applet in Browser
Download JRE 1.3 from Javasoft
save this to write.jp
keystore "/home/ray/raystore";
// A sample policy file that lets a JavaTM program
// create newfile in user's home directory
// Satya N Dodda
grant {
permission java.security.AllPermission;
save this to signedAppletDemo.java
* File: @(#)SignedAppletDemo.java     1.1
* Comment:     Signed Applet Demo
* @(#)author: Satya Dodda
* @(#)version: 1.1
* @(#)date: 98/10/01
import java.applet.Applet;
import java.awt.Graphics;
import java.io.*;
import java.awt.Color;
* A simple Signed Applet Demo
public class SignedAppletDemo extends Applet {
public String test() {
setBackground(Color.white);
     System.out.println(System.getProperty("user.home"));
     String fileName = System.getProperty("user.home") +
                    System.getProperty("file.separator") +
                    "newfile";
     String msg = "This message was written by a signed applet!!!\n";
     String s ;
     try {
     FileWriter fos = new FileWriter(fileName);
     fos.write(msg, 0, msg.length());
     fos.close();
     s = new String("Successfully created file :" + fileName);
     } catch (Exception e) {
     System.out.println("Exception e = " + e);
     e.printStackTrace();
     s = new String("Unable to create file : " + fileName);
     return s;
public void paint(Graphics g) {
g.setColor(Color.blue);
g.drawString("Signed Applet Demo", 120, 50);
g.setColor(Color.magenta);
g.drawString(test(), 50, 100);

Unable to export data from Web Access Data Sheet in Sharepoint to local excel or access file

Greetings and good morning.
I'm going to start off in broad terms with this question because I'm not 100 percent sure what information to provide.
Long story short, we've got a Web Access Data Sheet list hosted in a Sharepoint 2010 environment. It is accessed and used by multiple people throughout the day. It contains several thousand line item entries. I'd call it a large data sheet.
I think the size of the data sheet is casuign some instability in the list. I'd like to be able to export a defined range of data from the list into a local excel or access file. After that, I'd delete the stuff on the Access list to improve performance.
But...when I attempt to use the Sharepoint Action bar to export - Excel locks up/crashes. If I try to export to Access, I get a similar issue.
Any ideas? Could anyone begin by telling me what other information is required?

Hi,
If you would like to export data from Access Web Database in SharePoint 2010, you could go to Design With Access page in Settings. The url in my environment is http://sp/tt/_layouts/accsrv/ModifyApplication.aspx . Then choose the Table and export it to Excel
or Modify it in Access.
Regards,
Rebecca Tu
TechNet Community Support

Unable to access files with spaces in the path

Hi all, I am accessing files which reside on the server using a java applet.
The typical path of a file could be:
http://192.168.0.2/agat/data/AF190701 0003.agt
(not the space in the filename).
When I try to open this file using a URL object:
URL file = new URL(filename);
BufferedReader in = new BufferedReader(new InputStreamReader(file.openStream()));
I get exception 400 ( I think) whihc I assume is file cant be found.
However when I rename the file (to get rid of that space) and also change the filename variable to suit. The file is opened as expected.
What should I do to make the applet able to open paths with spaces? Or is this just not possible.
I did try including quotes with the special characte precessor:
filename = "/"http://192.168.0.2/agat/data/AF190701 0003.agt/""
But this didnt work either, please could someone tell what I need.
Thanks.

Thanks guys, although before I got your replies I did the following - it seems to work, but shall try your suggestions.
while (file.lastIndexOf(" ") >0)
String temp;
int num = file.lastIndexOf(" ");
temp = file.substring(0, num) + "%20" + file.substring(num+1, file.length());
file = temp;
}

Error accessing file template file not found (error code 2)

We have 3 admins that work on the website so we use the Check In/ Check Out feature of DW. We all have DW CS6.
When I update the template I have no problem (I work on a mac). However, if one of the other admins (Windows) tries he gets the following message: Error accessing file template file "C:\filepath\filename.dwt": file not found (error code 2).
I looked at this thread: Re: Dreamweaver Template not updating pages error code 2? but the only solution offered there is to change the template tag from <!-- InstanceBegin... to <!-- TemplateBegin... If this is the solution, how do you do this?
When I go to the url of the template http://www.christophorushouse.com.au/Templates/chrv-main-template.dwt it says it's been (re)moved or renamed, but then I have a feeling you can't view/access a template this way. All pages of the website feed of this template.
Any help would be appreciated.
Thanks

We have 3 admins that work on the website so we use the Check In/ Check Out feature of DW. We all have DW CS6.
When I update the template I have no problem (I work on a mac). However, if one of the other admins (Windows) tries he gets the following message: Error accessing file template file "C:\filepath\filename.dwt": file not found (error code 2).
I looked at this thread: Re: Dreamweaver Template not updating pages error code 2? but the only solution offered there is to change the template tag from <!-- InstanceBegin... to <!-- TemplateBegin... If this is the solution, how do you do this?
When I go to the url of the template http://www.christophorushouse.com.au/Templates/chrv-main-template.dwt it says it's been (re)moved or renamed, but then I have a feeling you can't view/access a template this way. All pages of the website feed of this template.
Any help would be appreciated.
Thanks

How do I access files with an iPad on a Lion Server?

One of the reasons I upgraded fron Snow Leopard server to Lion server is to access files from an iPad and iPhone. I see in the File Sharing sharepoint configuration box the iOS checkbox, but how do I get to the files from the iPad?

Thank you for shaking my brain! I kept looking for a file structure to show up, such as Fidner. Your answer got me thinking correctly. Instead of looking for a "Finder", I opened Pages on my iPad and touched "+" then "copy from webdav". From there I got a login screen and typed https://servername.com/webdav plus my credentials and it got me right to the files on the server! I can now access files on my server from my iPad and can save the changes back! It works both on the local network and remotely! Thanks again!
Message was edited by: FTZMan

How can I access files that I moved from an older MacBook Pro to a newer one via Firewire and Migration assistant. The files show up on the new MacBook but cannot be opened. Thanks!

How can I access files that I moved from an older MacBook Pro to a newer one via Firewire and Migration assistant? The files show up on the new MacBook but cannot be opened. Thanks!

Get info then check permissions then add your curent user name (it was probably different on old Mac) and give your username full read/write permissions.

How can I Write a sine wave in an Access-file?

I measure a sine wave in LabView 6i. How can I write the datas automatically to an Acces-file, at the same time?
In my program, I managed it with Execute SQL.vi, I change a number in a SQL statement(String) -> after this I push start and then it writes the statement in the Access-file.
The problem is, it writes only one data per measurement in the file. How can I write all datas in the Access-file and measure the wave at the same time?
Thanks for help!
Attachments:
getwave.vi ‏49 KB

On the waveform palette, you will find a "to components" vi that you can break out the array of the waveform. You can then, using a for loop write all of the values from the waveform.
Better yet, there are examples in the database toolkit manual on pages 3-13 to 3-15 that deal with reading arrays (and even has a waveform example).
Good luck!

Auditing Access file & LogParser

Similar Messages

Maybe you are looking for