Problem with Event Viewer

September 15, 2010 at 22:43:03
Specs: Windows XP
Hello,

We have a client-server tool installed in Windows 2003 server. This is an enterprise tool and the database used is flatfile system. What we have noticed that suddenly, some of the files goes missing in the database. They are deleted from the database. We have used Auditing feature which is turned ON for File/folder Delete. It is enabled for "Everyone".
The surprising thing is that when we login to the system and delete a file, the even gets registered in the event viewer. We have one more third party tool which keeps a watch on the database. It registers all the file deletes. But the same is not getting registered in Event viewer. What could be the issue and how to trace the culprit ?

Any help will be highly appreciated.

Thanks

Jagdish


See More: Problem with Event Viewer

Report •

#1
September 16, 2010 at 10:33:03
Sounds like the deletes are being done by the program.
These files should not be shared so what user access is there?

Report •

#2
September 19, 2010 at 20:34:36
User does not have any direct access to the folder

Report •

#3
September 20, 2010 at 09:31:56
Then the deletes are happening inside the program. Any database auditing available?

Report •

Related Solutions

#4
September 21, 2010 at 03:02:59
We have enabled "Folder / File Delete" Success. But the events are not getting registered.

Report •

#5
September 21, 2010 at 08:46:11
"When you use Windows Server 2003 auditing, you can track both user activities and Windows Server 2003 activities which are named events"

from here
http://support.microsoft.com/kb/814595

Since the deletes are neither being done by a user or server activities it is not covered in Event viewer logs. This appears to be happening programmically by the application. You would look at its logs not event viewer logs.


Report •

Ask Question