Can't find what you're looking for? Access our previous PDF-based library.
3 min read
️ Updated Sep 09, 2026Article ID | 1 |
Product | Lepide File Server Auditing |
Category | False Alerts / Noise Tuning / Disk Management |
Version | 26.1 |
Platform | Windows File Server |
1. Issue Summary
The customer was receiving back-to-back email alerts triggered by a large volume of File Copy and File Read events on their Windows file server. Alerts were firing because more than 50 events were being generated within a short time window. Investigation revealed the bulk of these events were system-generated noise (shortcut files with .lnk, .ix, and .msg extensions) rather than genuine user activity.
2. Symptoms / What the Customer Observed
Back-to-back email alerts triggered for File Copy and/or File Read operations.
Alerts fire even when users only browse (click open) a folder without copying any files.
File Rename alerts appearing even though users did not manually rename files (system auto-renamed shortcut files upon creation).
Lepide database size growing unusually fast (3.15 TB observed).
Disk space nearly full, prompting concern about needing to increase disk capacity.
No alerts received after the support session resolved the issue.
3. Root Cause Analysis
3.1 System-Generated Noise from .lnk Files
When a user opens a folder on a Windows file server, the operating system automatically reads and generates shortcut (.lnk) files for every file inside that folder. Each such action triggers a File Read event for all files in the folder in Lepide. This is normal Windows behaviour but creates a large volume of events that are not reflective of actual user activity.
Note: When the Customer opened the IT folder and then navigated back, the system generated 413 File Read events — none of which were actual file operations performed by the user.
3.2 .lnk Extension Not Excluded in Policy
The Lepide file server monitoring policy was not configured to exclude system-generated file extensions. As a result, all events — including those for .lnk, .ix, and .msg files — were being captured and stored in the database, contributing to both excessive alerts and rapid database growth.
3.3 .msg and .ix Extensions Also Generating Noise
During deeper analysis, additional system-generated extensions were identified — specifically .ix and .msg — which were also contributing noise to the event log and triggering alerts.
4. Resolution Steps Performed
4.1 Exclude System-Generated File Extensions from Policy
Navigated to the file server monitoring policy in Lepide and added exclusions for the following file extensions:
.lnk (Windows shortcut files)
.ix (system index files)
.msg (system message files)
These exclusions were applied across all monitored file servers.
4.2 Validate That Alert Threshold Is No Longer Being Breached
After applying the exclusions, a report was generated to verify the number of events. The event count dropped well below the defined threshold for the alert, confirming that alerts would no longer be triggered by system noise.
5. Recommendations for the Customer
5.1 Monitor Disk Space Growth
Continue monitoring how fast the Lepide database disk is filling up. If the rate of growth is still high after exclusions, there may be additional unfiltered extensions or activity that needs further tuning.