3 replies to this topic

[williamcheang]

In My Netwrix server, from the Search Result, it show that "Who: System" , what does that mean ?

 

NEWDC1 is my file server

I have created a text file remotely via NEWDC2 and login as cat\administrator

Am using Automatic Audit Setting, with no File Compression agent.

 

Who: system

Object type: File

Data source: File Servers

Monitoring plan: FileServer

Item: newdc1.cat.local (Computer)

Action: Added

What: \\newdc1.cat.local\NewShare_FrDC1\created remotely_DC2_Administrator_10_23am\xxxx10_23am.txt

Where: newdc1.cat.local

When: 4/16/2018 10:31:58 AM

[Paul.K]

Hi William,

 

It means that the product was not able to find the corresponding event in the target server security log, and it caused 'System' in the 'Who' field.

 

What is your current version of the product?

 

Please check that auditing settings are configured according to the following article:

 

https://helpcenter.n...ows_Shares.html

 

Thanks!

 

 

 

 

[mike v]

William,

Did you resolve this problem? I have the same issue. I'm going to look into what Paul said...

[williamcheang]

Based on what i experienced, in some cases, "Who=system" is due to Security Log size not set to 4GB and other audit policies that related to File Share Monitoring was set correctly.

 

But in other cases, where Audit Policy is set correctly and security Log is set 4GB and there is no error on collection.

The captured audit result still can show "Who=System", which i still do not understand...