Object Open, Is the user reading or just is a... Expand / Collapse
Author
Message
Posted 7/18/2016 1:00:26 PM
Forum Newbie

Forum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum Newbie

Group: Forum Members
Last Login: 8/4/2016 10:13:24 AM
Posts: 2, Visits: 3
Hello guys,

I'm trying to alert if any user is reading, but not sure if 4416 is only the permission or the action of reading.

These codes are what I see in the event,
%%1541 %%4416
1541 - SYNCHRONIZE,4416 - ReadData (or ListDirectory)

Do you know if is important to differentiate the "High level Generic Codes" and "File Codes" to get what I want?

Thanks in advance
Post #5236
Posted 7/24/2016 3:18:21 PM
Supreme Being

Supreme BeingSupreme BeingSupreme BeingSupreme BeingSupreme BeingSupreme BeingSupreme BeingSupreme Being

Group: Moderators
Last Login: 11/14/2013 3:17:47 PM
Posts: 237, Visits: 0
What is meant by "reading"?
Post #6241
Posted 8/4/2016 10:14:21 AM
Forum Newbie

Forum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum Newbie

Group: Forum Members
Last Login: 8/4/2016 10:13:24 AM
Posts: 2, Visits: 3
I'm trying to say when someone successfully open a file.
Post #6244
Posted 8/16/2016 8:25:38 PM
Supreme Being

Supreme BeingSupreme BeingSupreme BeingSupreme BeingSupreme BeingSupreme BeingSupreme BeingSupreme Being

Group: Moderators
Last Login: 11/14/2013 3:17:47 PM
Posts: 237, Visits: 0
I would use event ID 567 or 4663 but read data should be the appropriate "accesses" when a user tries to read the file.
Post #6251
« Prev Topic | Next Topic »


Permissions Expand / Collapse

All times are GMT -5:00, Time now is 8:01am