CSA does not Query User every time.

Unanswered Question
Aug 7th, 2009
User Badges:

We have been tasked to have a pop up (User Query) every time someone writes to a removable disk. We have the rule working, but it does not pop up every time a file is written. There seems to be a set time between pop ups. Is there a way to adjust that time? Can it be set to pup up every time someone writes to removable media?

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 4 (1 ratings)
johuston Fri, 08/07/2009 - 18:52
User Badges:

Hi Craig,

User queries are cached for 1 hour and that timer cannot be changed. However, you could modify the query so that it's unique each time which would cause the popup to come back. I'd recommend using the @filename cookie in your query response which should pop the query again when a different file is written to removable media.



craig.lepchenske Mon, 08/10/2009 - 11:04
User Badges:

Thank you Josh. Had that in place. I am disappointed the 1 hour timer isn't adjustable. That and the 256 character count for the query.

tsteger1 Mon, 08/10/2009 - 18:55
User Badges:
  • Red, 2250 points or more

You might be able to use a DAC or set rule to add files to an application class when written to removable drives.

You can also just log it. Create a file set with @removable and create a FAC rule and set the action to monitor to log when any application writes to that fileset.


jan.nielsen Wed, 08/12/2009 - 13:06
User Badges:
  • Gold, 750 points or more

You should be very carefull with trying to get it to popup everytime someone accesses a single file from the same app. It could cause large amounts of popups and cpu usage to do this. Just a word of caution


This Discussion