Advanced FS Logga settings
Filter out redundant events
Using an application to browse directories or open a often require multiple reads or writes. FS-Logga can ignore these redundant operations if they occur within a specified time period.
To reduce the amount of collected data:
- Enable (default) or disable the redundant events handling, separately for read and write events
-
Configure the time frame when FS Logga classifies events as redundant events.
Configuration file
pnTracer.config.xml
Computer
Collector server which is configured for the file server.
Path
%ProgramData%\Protected Networks\8MAN\cfg
If the file does not exist, copy the template from the following path:
old: %ProgramFiles%\Protected Networks\8MAN\etc
new: %ProgramFiles%\solarwinds\ARM\etc
Code
<?xml version="1.0" encoding="utf-8"?>
<config>
<tracer>
<fileserver>
<redundantEntriesHandling>
<removeRead type="System.Boolean">true</removeRead>
<removeWrite type="System.Boolean">true</removeWrite>
<!-- maximum time-diff in seconds to ignore read or write, default 10 -->
<maxTimeDiffForReads type="System.Int32">10</maxTimeDiffForReads>
<maxTimeDiffForWrites type="System.Int32">10</maxTimeDiffForWrites>
</redundantEntriesHandling>
</fileserver>
</tracer>
</config>
Possible Values
removeRead and removeRight
true
- as redundant classified operations are not recorded (default)
false
- all operations are recorded (not recommended)
maxTimeDiffForReads and maxTimeDiffForWrites
minimum 1 second
default 10 seconds
maximium 60 seconds
After you save the pnTracer.config.xml
file, stop and then start the FS Logga to enable your changes.
Record specific security ID operations on Windows file servers
The default non-recording of operations for the following security IDs (SIDs) can reduce the amount of recorded data.
S-1-5-18 NT-AUTHORITY\SYSTEM
S-1-5-19 NT-AUTHORITY\ LOCAL SERVICE
S-1-5-20 NT-AUTHORITY\ NETWORK SERVICE
The non-recording of operations for individual SIDs is not possible.
You can turn filtering off so all listed SID events are recorded.
Configuration file
pnTracer.config.xml
Computer
Collector server which is configured for the file server.
Path
%ProgramData%\Protected Networks\8MAN\cfg
If the file does not exist, copy the template from the following path:
old: %ProgramFiles%\Protected Networks\8MAN\etc
new: %ProgramFiles%\solarwinds\ARM\etc
Code
<?xml version="1.0" encoding="utf-8"?>
<config>
<tracer>
<windows>
<suspendfilter type="System.Boolean">true</suspendfilter>
</windows>
</tracer>
</config>
Possible values
true
- events of the listed SIDs are not recorded (default)
false
- events of the listed SIDs are recorded (not recommended)
After you save the pnTracer.config.xml
file, stop and then start FS Logga to enable your changes.
Change the directory for temporary Logga files
By default, temporary Logga files are stored at:
%ProgramData%\Protected Networks\8MAN\
To change the file location, edit the configuration file.
Configuration file
pnTracer.config.xml
Computer
Collector server which is configured for the file server.
Path
%ProgramData%\Protected Networks\8MAN\cfg
If the file does not exist, copy the "template" from the following path:
old: %ProgramFiles%\protected-networks.com\8MAN\etc
new: %ProgramFiles%\solarwinds\ARM\etc
Code
<?xml version="1.0" encoding="utf-8"?>
<config>
<tracer>
<localStoragePath>E:\other\directory</localStoragePath>
</tracer>
</config>
Possible values
Enter the local storage path.
After you save the pnTracer.config.xml file
, stop and then start FS Logga to enable your changes.