File Server Auditing – Data Flow to Lepide

The image above explains how File Server Auditing data flows to Lepide and where data is queued or logged during failure scenarios. Lepide supports two deployment modes for File Server Auditing:

Option 1: File Server Mode

Normal Data Flow

• User activity occurs on the File Server.

• Lepide Agent installed on the File Server captures file access events.

• The agent directly sends audit data to the SQL Database.

Flow:

File Server → Lepide Agent (on File Server) → SQL Database

Failure Scenario: SQL Server Unreachable

• If the SQL Server is down or unreachable, the Lepide Agent cannot insert records into the database.

• Audit data is queued locally on the File Server until SQL connectivity is restored.

Data Queue Location:

<Agent-Directory>\LFSAgent\LepideDBFailedRecord

Logs to Check (File Server Mode)

Debug logs are available only on the agent server:

• Agent errors:

C:\Windows\LFSAgent\FSAagentLog.txt

• SQL insertion errors:

C:\Windows\LFSAgent\FsaErrLog.txt

Option 2: Lepide Console Mode

Normal Data Flow

• User activity occurs on the File Server.

• Lepide Agent on the File Server captures events.

• Events are forwarded to the Lepide Server (Console).

• Lepide Server inserts the data into the SQL Database.

Flow:

File Server → Lepide Agent → Lepide Server → SQL Database

Failure Scenario 1: Lepide Server Unreachable

• If the Lepide Server service is down or unreachable:

• Audit data is queued locally on the File Server.

Data Queue Location:

C:\Windows\LFSAgent\Logs

Failure Scenario 2: SQL Server Unreachable

• If the Lepide Server is reachable but the SQL Server is down:

• Data is queued on the Lepide Server until SQL connectivity is restored.

Data Queue Location:

<Lepide-Directory>\FSA\LepideFSASettings

Logs to Check (Lepide Console Mode)

• Agent errors (on File Server):

C:\Windows\LFSAgent\FSAagentLog.txt

• SQL insertion errors (on Lepide Server):

C:\Program Files (x86)\Lepide Data Security Platform\FsaErrLog.txt