B.2 File System Events

You configure which file system events are logged in the NCP Server object’s Novell Audit > NetWare page and in the NetWare Instrumentation. For more information, see Configuring NetWare and File System Events.

This section reviews the file system events that Novell Audit can log.

NOTE:The events are listed in the order they appear in the NCP Server object’s Novell Audit > Filesystem page.

Table B-2 File System Events

EventID

Property Label

Description

000A0001

File Delete

An existing file has been deleted.

To generate this event, delete an existing file.

000A0002

File Open

An existing file has been opened for access. This event is very common.

To generate this event, edit an existing file.

000A0003

File Create

A new file has been created. This event is not applicable to NSS.

To generate this event, attempt to edit a non-existent file or use an editor to save a new file.

000A0004

File Create & Open

A new file has been created and immediately opened for access.

To generate this event, attempt to edit a non-existent file or use an editor to save a new file.

000A0005

File Rename

An existing file or directory has been either renamed or moved to another location.

To generate this event, rename a file or directory.

000A0006

File Close

A previously open file has since been closed. This event is very common.

To generate this event, open or create a file. Close the file or exit the application used to open or create the file.

000A0007

Directory Create

A new directory has been created.

To generate this event, create a new directory.

000A0008

Directory Remove

An existing directory has been deleted.

To generate this event, delete an existing directory.

000A0009

Directory Modified

A file or directory has been modified.

To generate an instance of this event, enable the Read-Only attribute for an existing file or directory.

000A000A

File Salvaged

A previously deleted file has been salvaged (undeleted).

To generate this event, use the Salvage feature of the Novell Client™ to find and restore a file.

000A000B

File Purged

A previously-deleted file has been purged (permanently deleted).

To generate this event, use the Purge feature of the Novell Client to find and permanently delete a file.

000A000E

DOS Attributes Modified

The generic DOS information for a file system entry has been modified. This event is not applicable to NSS.

To generate an instance of this event, use the Novell Filer utility, filer.exe, to change the read-only flag on a file.

000A000F

Trustee Added

A trustee has been added to a file or directory.

To generate this event, locate an existing file or directory and assign an eDirectory object to be a trustee.

000A0010

Trustee Removed

A trustee has been removed from a file or directory.

To generate this event, locate an existing file or directory with at least one assigned trustee. Remove a trustee assignment from that file or directory.

000A0011

Trustee Modified

An existing file or directory trustee has been modified.

To generate this event, locate an existing file or directory with at least one assigned trustee. Change the rights granted to one of those trustees.