How to get the correct gid/uid on windows fschange events

[oreoshake]

All of my events show up with gid=-1,uid=-1. Is this a bug or am I doing something wrong?

[jrodman · Accepted solution]

Windows does not have a gid or uid, thus these fields come in as "unset". The equivalent concepts on Windows are owner and ACL list, which cannot be expressed as two numbers.

If we don't currently capture Owner, that's kind of a shame. It shouldn't be too difficult to put that in a field. ACL list is pretty tricksy as it can be arbitrarily complex. Should at least be an ER to capture that stuff.

[jrodman]

If our marketing collateral is out of step with the hard requirements of compliance specifications, that definitely deserves to be addressed. Get the ball rolling with a support ticket. Eventually it becomes an internal discussion to get things sorted, I think, but you'd be doing us a favor to apply the lever.

[oreoshake]

I agree!!! Or at least put asterisks on your compliance advertisements!