Auditing has come a l-o-n-g way since the old Autitcon days. A long way. They now support dumping the event-log to a wide selection of repositories, including flat-file, JDBC->Oracle, JDBC->MSSql, MySQL, and SMTP for some reason. Lots of repositories.
Can we use this? Probably. Will we use it? Probably not. Logs like that are generally used when a lawsuit hits or we need to trace down precicely what happened. And thumbing through potentially terabytes of data for just those events is not the best use of limited resources.
All this came up with a vendor troubleshoot. This particular package is behaving badly when its files are on the Netware cluster, and the vendor doesn't know why. It is clear we're dealing with MS-trained techs out of their depth in a NetWare world. They've asked us for our "novell logs" for the directory in question, and access logs for the specific time period. Um... don't have it. We could get it in, but give us a month to get the system set up correctly.
Can we use this? Probably. Will we use it? Probably not. Logs like that are generally used when a lawsuit hits or we need to trace down precicely what happened. And thumbing through potentially terabytes of data for just those events is not the best use of limited resources.
All this came up with a vendor troubleshoot. This particular package is behaving badly when its files are on the Netware cluster, and the vendor doesn't know why. It is clear we're dealing with MS-trained techs out of their depth in a NetWare world. They've asked us for our "novell logs" for the directory in question, and access logs for the specific time period. Um... don't have it. We could get it in, but give us a month to get the system set up correctly.