lccDiskWatcher Homepage

Project LID Homepage: Distributable Modules

Updates

2/12/2024: Upgrade: quarantine skips processing if a file is renamed.

9/5/2023: Upgrade: Added keys "lcc:quarantineTranscriptsPath", "lcc:quarantinePath".

3/9/2023: Upgrade: Added new lcc:logPath category 'Root'.

10/11/2019: Upgrade: changed lcc:filter logic so that if multiple scopes used, i.e. "File Name", "File Ext", etc. each scope needs to pass for the file to be flagged.

10/2/2019: Upgrade: added keys "lcc:pathReplace", "lcc:lastPathMessage"

9/9/2019: Upgrade: Added date to console/email records.

8/22/2019: Upgrade: Added Flags to key lcc:SMTP.

8/13/2019: Upgrade: Unique Paths mode can now provide counts.

8/8/2019: Upgrade: confirmation that all log paths are unique. Now ignores 'directory' changes, only reports file changes.

8/7/2019: Upgrade: added 'Day/Time' to lcc:filter. Changed lcc:filter and lcc:filterOut on "File Name" or "File Ext" to full name or partial, i.e. exact matches no longer needed.

8/5/2019: Upgrade: added 'Run Modes'.

8/1/2019: Upgrade: added flags to some keys.

7/31/2019: Upgrade: added "File Name" to lcc:filter, lcc:filterOut.

7/30/2019: Upgrade: added email notifications, report frequency with keys lcc:SMTP and lcc:reportFrequency. Added key lcc:reportMaxQueue.

7/23/2019: Code Released

Description

lccDiskWatcher is a command line program that can monitor disk activity across one to many machines/disks at the same time.

In testing, we have had it monitoring 200+ machines/disks at the same time with minimal resources used and immediate feedback.

The program can log each machine's stats out to individual logs, as well as to a central log for all machines.

The program can be configured for 'thresholds'. Thresholds let the program know when it should alert about too many changes to files.

The main usages of this program are:

monitor disks for files being created, changed, deleted, renamed and if thresholds are met, show/log alerts
monitor disks for specific file types being created, changed, deleted, renamed, like exectuables, scripts, etc.

Each machine/disk being audited, is considered a 'set'.

Documents

lccDiskWatcher Manual

Installation

lccDiskWatcher-installation.zip

Example Files

Disclaimer
The programs, scripts and documentation are provided AS IS without warranty of any kind. Lower Columbia College further disclaims all implied warranties including, without limitation, any implied warranties of merchantability or of fitness for a particular purpose. The entire risk arising out of the use or performance of the programs, scripts and documentation remains with you. In no event shall Lower Columbia College, its authors, or anyone else involved in the creation, production, or delivery of the programs, scripts or documentation be liable for any damages whatsoever (including, without limitation, damages for loss of business profits, business interruption, loss of business information, or other pecuniary loss) arising out of the use of or inability to use the programs, scripts or documentation, even if Lower Columbia College has been advised of the possibility of such damages.