Apparently File Sight can't make the distinction between listing files in a folder without opening them (registers it as a "read") or actually opening files (which is also registered as a "read"). This is how Windows stores the events in the event log when auditing is enabled.

I need to be a 100% certain that a file has been opened by the user. How do I accomplish this with File Sight?

asked 16 Apr '15, 07:47

smyttie's gravatar image

smyttie
1112
accept rate: 0%


Hi Smyttie,

You could make a few some adjustments to your monitor. The first would be to ignore the process that is listing your files. Listing files is usually done by using Windows File Explore. You can ignore that process marking the explorer process in the Ignore tab called Processes. The second option is to raise the "Minimum # of bytes read or written in order to get a reported" from 25 to another number that you fell will better fit your needs.

File Sight - File Access Monitor

Thanks
Quinn

Please make sure to mark your questions accepted when you have your answer by clicking the gray check mark to the left of the answer.

link

answered 17 Apr '15, 11:13

Quinn's gravatar image

Quinn ♦♦
14.0k3925
accept rate: 37%

Hi Quinn,

thanks for your reply. I have a remark on both of your suggestions :

  • ignoring "explorer" is not very helpful because 99% of access is by "system or network"
  • "minimum bytes" value is at the standard 25 bytes, but even 2 byte files are reported, although they are not opened

I run this on a file server with Windows 2012 Standard and folders/files are managed with DFS.

I find it very weird that Microsoft or any other company (I have tested several tools) are not able to tell me with certainty, in a simple way, if a file was opened or not.

Best regards, Smyttie

link

answered 20 Apr '15, 01:58

smyttie's gravatar image

smyttie
1112
accept rate: 0%

No tweaks, tuning, any tips? Anyone?

link

answered 24 Apr '15, 06:43

smyttie's gravatar image

smyttie
1112
accept rate: 0%

The problem is Windows Explorer will open and read a little bit of the file when it is 'listed' to help it decide which icon to show. That's every bit as much of a read file as if Word had read the file in. The difference though is Explorer will just read a small amount, maybe 100 bytes. So for most files that are typically at least a few KB, ignoring those small file reads effectively filters out Explorer's 'listing' of files.

link

answered 07 May '15, 23:47

Doug's gravatar image

Doug ♦♦
10.1k112037
accept rate: 21%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Tags:

×28
×4
×3
×2

Asked: 16 Apr '15, 07:47

Seen: 4,571 times

Last updated: 07 May '15, 23:47