Kix Log File Question:

[n30_mkii]

We have around 10,000 users and at various stages in our logon script we have entries like this.

If Open (1, "\\server\share\file.csv", 5) = 0
$SpecLine = $Dept+ ","+ %clientname% + "," + @USERID + ","+ @FullName + "," + @DATE + ", at ," + @time
$WriteData = WriteLine (1, $SpecLine + Chr(13) + Chr(10))
Close(1)
EndIf

Obviously these files grown fairly quickly and I have archived them off numerous times. I just have a little niggle at the back of my mind about how the clients execute this.

If say the file had grown to 200mb's in size, do the clients have to pull that over the network in order to write to it? if so that could be causing some issues! Especially over slow links. Any thoughts? I have proposed our logging should be done into SQL because of the amount we capture. The other issue being on a monday morning the file will probably be locked constantly and not everything captured even if logons happen over a couple of hours.

Does that make sense and can anyone clarify?

I will do a little testing next week

 

[Gerbil]

If say the file had grown to 200mb's in size, do the clients have to pull that over the network in order to write to it?

I'd say that's likely to be true and a brief check with Wireshark should confirm it. So at best it's slowing down the logons and at worst due to the file locking issues you've mentioned it's also possibly missing entries and therefore inaccurate.

If you need to log in that fashion then how about just having the script create a log file based on the username in the central shared directory? The individual file sizes stay small and there's no locking issues. Create a batch process on the central server that hoovers up the individual files once a day and either amalgamates them into one CSV file or stuffs them into SQL as you were proposing.

Is this used for audit purposes of just to track active accounts? It's it's for auditing then users have got the rights to read and write to that directory so a user who knows what they're doing can just modify the files to delete or insert records as they see fit. If it's for tracking active/inactive accounts then lastLogonTimestamp exists at W2K3 domain functional level and might be good enough to track what you want.