Perl for System Administration

Tracking File and Network Operations

For our last section of this chapter, we’re going to lump two of the user action domains together. The processes we’ve just spent so much time controlling do more than just suck up CPU and memory. They also perform operations on filesystems and communicate on a network on behalf of a user. User administration requires that we deal with these second-order effects as well.

Our focus is going to be fairly narrow. We’re only interested in looking at file and network operations that other users are performing on a system. We’re also only going to focus on those operations that we can track back to a specific user (or a specific process run by a specific user). With these blinders in mind, let’s go forth.

Tracking Operations on Windows NT/2000

If we want to track other users’ open files, the closest we can come involves using a third-party command-line program called nthandle by Mark Russinovich, found at http://www.sysinternals.com. It can show us all of the open handles on a particular system. Here’s some sample output:

System pid: 2 10: File C:\WINNT\SYSTEM32\CONFIG\SECURITY 84: File C:\WINNT\SYSTEM32\CONFIG\SAM.LOG cc: File C:\WINNT\SYSTEM32\CONFIG\SYSTEM d0: File C:\WINNT\SYSTEM32\CONFIG\SECURITY.LOG d4: File C:\WINNT\SYSTEM32\CONFIG\DEFAULT e8: File C:\WINNT\SYSTEM32\CONFIG\SYSTEM.ALT fc: File C:\WINNT\SYSTEM32\CONFIG\SOFTWARE.LOG 118: File C:\WINNT\SYSTEM32\CONFIG\SAM 128: File C:\pagefile.sys 134: File C:\WINNT\SYSTEM32\CONFIG\DEFAULT.LOG ...