Find filename existed on servers

Question

Hey everyone, I want to find a file named "baocao.docx" on 100 server to see if any file with that name exists on servers and location of this file. How could I do that? 
 I have tried " File.01.3 - Files on disk (path-filename)" in live discovery feature but sophos technical support say that "the "File.01.3 - Files on disk (path-filename)" search will only look for the file within immediate files and will not search within subfolders."

Sophos User930 · Accepted Answer

Maybe you can find it in the sophos_file_journal table: https://docs.sophos.com/central/References/schemas/index.html?schema=endpoint_schema 
 You will want to use the where file = ' baocao.docx' 
 by default the time only goes back 15 mins unless you use the "time" column to specifiy. 
 Note: If the window of time is too large it could hit a CPU limit. 
 You can use Epoch Converter - Unix Timestamp Converter to get a starting point, e.g. time > 1735257600 FileOtherChanges or FileOtherReads would be the subject for: 
 SELECT * FROM sophos_file_journal where file like '%.txt' and time > 1735257600

Find filename existed on servers

Top Replies