Its seems that its OK,
my logs for the external USB 3.5' hard drave are:
9/30/2006 - 1:22:55 PM USB storage device attached: 'USB TO IDE' /
'USB Mass Storage Device' / 'Compatible USB storage device'
9/30/2006 - 1:24:57 PM USB storage device removed: 'USB TO IDE' / 'USB
Mass Storage Device' / 'Compatible USB storage device'
I will try it with other devices.
We shall see how will USBlogger react when times passes, and are there
some mem. leakage after times, is it core stable with User and GDI
objects, is it compatible with other software.
You are right there is market gap, but I wouldn't call it gap, but
Microsoft mistake, they didn't thought about events enough, on the
unix/linux platform there aren't such stupid mistakes.
Thanks for the effort.
Uwe Sieber wrote:
> Seems to be a gap in the market...
>
> I've stripped down another software, added some logging
> and here it is: The USB device logger :-)
> http://www.uwe-sieber.de/files/usblogger.zip
>
> It's a Windows service that logs USB device arrivals and
> removals.
> This version logs to the file C:\_USBdevices.txt but it's
> no problem to let it log to a different file or to the Windows
> event log.
>
> Log sample:
>
> 29.09.2006 - 16:41:37 USB storage device attached: 'U3 Cruzer Micro' /
> 'USB-Massenspeichergerät' / 'Kompatibles USB-Speichergerät'
>
> 29.09.2006 - 16:41:47 USB storage device removed: 'U3 Cruzer Micro' /
> 'USB-Massenspeichergerät' / 'Kompatibles USB-Speichergerät'
>
> 29.09.2006 - 16:41:54 Bluetooth device attached: 'USB Device' /
> 'Generic Bluetooth Radio' / 'Cambridge Silicon Radio Ltd.'
>
> 29.09.2006 - 16:41:59 Bluetooth device removed: 'USB Device' / 'Generic
> Bluetooth Radio' / 'Cambridge Silicon Radio Ltd.'
>
>
> Let me know what you think...
>
>
> Greetings from Germany
>
> Uwe
>
>
>
>
> wrote:
> > For this matter there are 3 solutions that I found by this day,
> > USB device logging
> > http://studentweb.eku.edu/philip_gum...p/usb_logging/
> >
> > DeviceLock®
> > http://www.protect-me.com/dl/
> >
> > Safend USB Auditor
> > http://www.portprotector.com/USB-auditor.asp
> >
> > USB monitor is big and I tried it, its resource hoggish, and it doesn't
> > log like I need.
> >
> > David Vair wrote:
> >> I use USB Monitor to get the details of what is connected to each port, I see it has a logging
> >> feature but I have never used it. They have a trial version you can use to see if thats what your
> >> looking for:
> >>
> >> http://www.hhdsoftware.com/Products/home/usb-monitor.html
> >>
> >> --
> >> Dave Vair
> >> CNE, CNA, MCP, A+, N+
> >>
> >> "DL" <address@invalid> wrote in message ...
> >>> Type Date Time Source Category Event User Computer
> >>> Information 27/09/2006 22:00:10 Removable Storage Service None 135 N/A *****
> >>> Information 27/09/2006 21:59:34 Removable Storage Service None 134 N/A *****
> >>>
> >>> Naturally the properties for these events show more detail
> >>> eg started/stopped etc
> >>>
> >>> > wrote in message
> >>> ps.com...
> >>>> As I said, not only that I tried all the available Intel chipset and
> >>>> the USB drivers, and all of the available microsoft drivers, I tried
> >>>> even some open source drivers, and none of them support such logging as
> >>>> I described.
> >>>> If you have time, please upload somewhere screenshots of your system
> >>>> event logs where you see events with USB activities as I described.
> >>>>
> >>>> DL wrote:
> >>>>> Since I don't use Intel mobo I cannot really comment further other than
> >>>>> reiterating that you should ensure you are using the mobo drivers, inc
> >>>>> chipset, from their site, and not winxp default drivers.
> >>>>>
> >>>>>
> >>>>> > wrote in message
> >>>>> ups.com...
> >>>>>> Personally, I tried several drivers for Intel motherboards, Microsoft
> >>>>>> xpsp2 integrated in xpsp2 and I tried several versions of Intel usb
> >>>>>> drivers from Intel.
> >>>>>> DL wrote:
> >>>>>>> Must be my mistake then, I only have an nvidea chipset/mobo and its
> >>> all
> >>>>>>> recorded in even viewer
> >>>>>>> So your certainty is not my experience
> >>>>>>> But then perhaps you used winxp default drivers and not the manu
> >>> drivers
> >>>>>>> > wrote in message
> >>>>>>> oups.com...
> >>>>>>>> Not that I know, only thing that's recorded by the event viewer
> >>> are
> >>>>> the
> >>>>>>>> errors made by the ftdisk.
> >>>>>>>>
> >>>>>>>> And there are some USB pci cards, which are equipped with the USB
> >>>>>>>> drivers that will transfer such activate message log to the event
> >>>>>>>> viewer.
> >>>>>>>>
> >>>>>>>> In the case of the Intel motherboards, generations from a BX, 815,
> >>>>> 845,
> >>>>>>>> 865, 875, 915, 945, 975, and with a very large amount of
> >>> motherboards
> >>>>>>>> based on via and nvidia, I can say for certain that they are not
> >>>>>>>> equipped with the driver and the audit policy which will transfer
> >>> such
> >>>>>>>> activities to the event viewer.
> >>>>>>>>
> >>>>>>>>
> >>>>>>>> DL wrote:
> >>>>>>>>> An external hd usb connection/removal is logged in my System
> >>> Log,
> >>>>> Event
> >>>>>>>>> Viewer
> >>>>>>>>>
> >>>>>>>>> > wrote in message
> >>>>>>>>> ups.com...
> >>>>>>>>>> I'm searching for a simple USB activity logger, nothing big, I
> >>>>> need
> >>>>>>>>>> just to log when someone plugged and unplugged any USB device,
> >>>>>>>>>> (ext.hdd, ext. mem.stick, ext.sound card), like,
> >>>>>>>>>> at 12.09.06 12.06h External disk drive activated
> >>>>>>>>>> at 12.09.06 13.05h External disk drive deactivated
> >>>>>>>>>>
> >>>>>>>>>> It could be excellent if Windows XP internal system logger
> >>> could
> >>>>> log
> >>>>>>>>>> such activities to event logger.
> >>>>>>>>>>
> >>>
> >