Auditing old files on your File Server

[wirestyle22]

@aaronstuder Thanks

[scottalanmiller]

The find command is all you need on Linux.

[travisdh1]

@scottalanmiller said in Auditing old files on your File Server:

The find command is all you need on Linux.

Yeah, lots of options with find and time based searches.

-amin last accessed n minutes ago
-atime X last accessed X24 hours ago
-ctime X status changed X24 hours ago
-mtime X data was last modified X*24 hours ago

The man page is rather large for find, but is easy to find the options you want......

I'll get my coat.

[dafyre]

@travisdh1 said in Auditing old files on your File Server:

@scottalanmiller said in Auditing old files on your File Server:

The find command is all you need on Linux.

Yeah, lots of options with find and time based searches.

-amin last accessed n minutes ago
-atime X last accessed X24 hours ago
-ctime X status changed X24 hours ago
-mtime X data was last modified X*24 hours ago

The man page is rather large for find, but is easy to find the options you want......

I'll get my coat.

It's important to note that some file systems can have the atime option disabled to provide performance boosts and/or cut down on writes to drives.

[travisdh1]

@dafyre said in Auditing old files on your File Server:

@travisdh1 said in Auditing old files on your File Server:

@scottalanmiller said in Auditing old files on your File Server:

The find command is all you need on Linux.

Yeah, lots of options with find and time based searches.

-amin last accessed n minutes ago
-atime X last accessed X24 hours ago
-ctime X status changed X24 hours ago
-mtime X data was last modified X*24 hours ago

The man page is rather large for find, but is easy to find the options you want......

I'll get my coat.

It's important to note that some file systems can have the atime option disabled to provide performance boosts and/or cut down on writes to drives.

Yep. Just because it's an option, doesn't mean it'll work with your particular system.

[dbeato]

Are you doing this for Windows or Linux Servers?

[wirestyle22]

@dbeato said in Auditing old files on your File Server:

Are you doing this for Windows or Linux Servers?

Both

[dbeato]

@wirestyle22 nice. I would what was recommended above with the Find command in linux.

For Windows you can look this:
https://blogs.technet.microsoft.com/filecab/2009/05/11/dealing-with-stale-data-on-file-servers/
https://technet.microsoft.com/en-us/library/dd759233(v=ws.11).aspx

TreeSize also works.

[wirestyle22]

@dbeato said in Auditing old files on your File Server:

@wirestyle22 nice. I would what was recommended above with the Find command in linux.

For Windows you can look this:
https://blogs.technet.microsoft.com/filecab/2009/05/11/dealing-with-stale-data-on-file-servers/
https://technet.microsoft.com/en-us/library/dd759233(v=ws.11).aspx

TreeSize also works.

much appreciated

[joelbarlow40]

First you need to enable auditing of object access as:

Whichever Top Level Policy-->Computer Configuration-->Windows Settings-->Security Settings-->Local Policies-->Audit Policy-->Audit Object Access - you can enable success/failure. Please check out the given below links:

Configuring Audit Policies

http://technet.microsoft.com/en-us/library/dd277403.aspx

How To Set, View, Change, or Remove Auditing for a File or Folder in Windows 2000

http://support.microsoft.com/kb/301640

Apply or modify auditing policy settings for a local file or folder

http://technet.microsoft.com/en-us/library/cc784387.aspx

[stacksofplates]

@scottalanmiller said in Auditing old files on your File Server:

The find command is all you need on Linux.

Systemd's systemd-tmpfiles-clean service is a good utility too.