Ayup. Syslog is your friend, or some other remote log collection facility,
On Mon, Aug 24, 2009 at 15:41, Andrew S. Baker<asbz...@gmail.com> wrote: > You really don't want to make your eventlog sizes that big. The eventlogs > are memory mapped files and will consume as much RAM as the sum of their max > sizes. That's a lot of RAM to eat up for the logs, even if your server has > 4GB RAM. > > -ASB > > > > On Mon, Aug 24, 2009 at 5:41 PM, Richard Stovall > <richard.stov...@researchdata.com> wrote: >> >> Not really. You could start with something like 128MB and see how many >> days you get with that. >> >> >> >> From: Jim Majorowicz [mailto:jmajorow...@gmail.com] >> Sent: Monday, August 24, 2009 5:21 PM >> >> To: NT System Admin Issues >> Subject: RE: Troubleshooting a file problem >> >> >> >> Do you have a size you’d recommend? There are approximately 40 users >> overall. I’d probably need it big enough to keep at least 3 or 4 days of >> data. Right now I just empty them every month to file and burn them to cd >> and stash them when I do the updates for that month. >> >> >> >> From: Richard Stovall [mailto:richard.stov...@researchdata.com] >> >> Sent: Monday, August 24, 2009 2:10 PM >> To: NT System Admin Issues >> Subject: RE: Troubleshooting a file problem >> >> >> >> Why would auditing require a bunch of hard disk space? Just manage your >> log sizes and you should be OK. I do it all the time. >> >> >> >> Unless I’m missing something… >> >> >> >> From: Jim Majorowicz [mailto:jmajorow...@gmail.com] >> >> Sent: Monday, August 24, 2009 4:51 PM >> To: NT System Admin Issues >> Subject: Troubleshooting a file problem >> >> >> >> I’ve got a tricky situation with disappearing files at one of my clients. >> The server in questions is a Windows SBS 2003 R2 Std that is currently up to >> date. Here’s the situation: >> >> >> >> They’ve got a series of folders for all the projects they work on that are >> accessed by a number of different departments. The file structure for the >> Projects is that they’re listed by project number then name, and under each >> of those folders is a standard template that contains information from each >> department in their own folders. It looks something like this: >> >> >> >> Projects: >> >> |-10000 – Project #1 >> >> | |-Billing >> >> | |-Drawings >> >> | |-Engineering >> >> | |-Proposal >> >> | |-Etc. >> >> |-10010 – Project #2 >> >> |-20132 – Project #3 >> >> . >> >> . >> >> . >> >> |- 99999 – Project Template >> >> |-Archive >> >> |-Etc. >> >> >> >> What happens is, about once every other month or so somewhere in that list >> of projects one folder will lose about ½ of the folders and data inside it >> and all the Project folders and other information below that spot >> “disappear”. They can be successfully restored via Shadow Copy, but the >> client wants to know exactly what is happening and prevent it from >> happening. >> >> >> >> The only thing I can think of is that somebody has these folder all >> expanded in Windows Explorer and somehow manages to click and select a >> random folder in the list, select it and everything below it in that view >> and delete it. But I can’t prove who, when and why and they want these >> answers. >> >> >> >> I’m hesitant to turn on file access logging, as that would require a bunch >> of hard drive space while we’re waiting for this to happen again. Their >> onsite desktop support guy seems to want to blame the Shadow Copy service >> since the last time this happened he was working with data in one of the >> folders that got deleted that morning, but it was gone that afternoon after >> the Shadow Copy had fired off at noon. >> >> >> >> Is there a better way to figure out what is happening, or do I just need >> to suck it up, turn on file access logging, make some space for the logs and >> wait for it to occur again? >> >> >> >> Regards, >> >> Jim Majorowicz, MCP >> >> Sr. Network Engineer >> >> Whitsell Computer Services >> >> (503) 297-8440x12 >> >> www.whitsell.com >> >> We can support you no matter where you are. Ask me for details. >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> >> > > > > ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~
