Sysadmin

This is an automated archive.

The original was posted on /r/sysadmin by /u/CertainlyBright on 2023-08-17 19:17:57+00:00.

I setup file auditing to track when a user deletes files or folders, and creates files and folders within a directory.

(this is the guide I used)

Whenever the user creates a text file, it first shows up as "New text document.txt" and when it is renamed to "test.txt" I get an event that a file was created, but that new name "test.txt" doesn't show up, it just says that within a folder a file was created, but it doesn't give me the specific file name created, my only hint is that just before, a "new text document.txt" was created and deleted.