Well, a centralized monitoring tool is in development right now at NetApp,
but another easier approach would be to leverage auditing on shares,
possibly tracking on "successful mounting of a share" events. That way, you
would know each time a share is mounted, who did it, etc.
-----Original Message-----
From: Monica Lam [mailto:Monica.Lam@cosinecom.com]
Sent: Tuesday, March 06, 2001 11:05 AM
To: 'White, Lance'; 'toasters(a)mathworks.com'
Subject: RE: Is there a way to tell who is mapping specific filer cifs sha
res?
Thanks. Actually, I was hoping for a simpler way to gather the
information on all the user's who are mapping shares and which shares
at a specific time.
For instance, if an extra parameter can be added to the
cifs sessions command (verbose maybe) that would also display
the shares the users are using at the same time. That way
I wouldn't have to run cifs sessions username on each user
that has an open session.
Also, since the information is available in the NT server manager,
I thought maybe someone might have the command line to get
that information from NT.
If there isn't such a thing, then I guess a script that takes the output
from cifs sessions that parses out the username and then runs the
cifs session username will be the way to go.
Thanks
-----Original Message-----
From: White, Lance [mailto:Lance.White@netapp.com]
Sent: Tuesday, March 06, 2001 10:49 AM
To: Monica Lam; 'toasters(a)mathworks.com'
Subject: RE: Is there a way to tell who is mapping specific filer cifs sha
res?
Do this via rsh command to a Filer, or on the Filer itself.
Displaying CIFS session information
BM_1288165
CIFS session information you can display
BM_1263345You can display information about connected users and the number
of shares and open files for each user. You can also display information
about a specific connected user.
BM_1263347
Displaying information with the cifs sessions command
BM_1263348The cifs sessions command syntax is as follows:
BM_1263349
cifs sessions <username>
BM_1263351
Displaying information about all connected users
BM_1263352To display information about all connected users, use the
following command syntax:
BM_1263354
cifs sessions
BM_1263355Sample output is
BM_1263356
Server Registers as 'TOASTER` in group WNT-DOMAIN
BM_1263357
WINS Server: 272.320.0.4
BM_1263358
PC style Access Control is being used
BM_1263359
Using domain controller WNT-DOMAIN-PDC for authentication
BM_1263360
========================================
BM_1263361
PC (user) #shares #files
BM_1263362
SMITHPC (qsmith) 1 1
BM_1263363
PETERSPC (zpeters) 2 3
BM_1263364
Displaying information about one user
BM_1263365To display the information for a particular user, specify the user
name in the command; for example:
BM_1263366
cifs sessions ghopper
BM_1263367
users
BM_1263368
shares/files opened
BM_1263369
BM_1263370
HALEY-HOME1 (ghopper)
BM_1263371
ENG-USERS
BM_1263372
Read-denyW -
\GHOPPER\SRC\PROD\COMMON\HTTPD\httpd_fast.c
BM_1263373
BM_1263374
BM_1263375
HALEY-PC (ghopper)
BM_1263376
ENG-USERS
BM_1263377
Displaying connected user security information
BM_1263378To display security information for each connected user, use cifs
sessions with the -s option. After the first two lines, detailed information
for each connected user is displayed. The following example lists only one
user.
BM_1263379
cifs sessions -s
BM_1263380
users
BM_1263381
Security Information
BM_1263382
BM_1263383
HOLARD-PC (root)
BM_1263384
***************
BM_1263385
UNIX uid = 0
BM_1263386
user is a member of group daemon (1)
BM_1263387
user is a member of group www (204)
BM_1263388
user is a member of group well (0)
BM_1263389
user is a member of group http (500)
BM_1263390
BM_1263391
NT membership
BM_1263392
WNT-DOMAIN\root
BM_1263393
WNT-DOMAIN\Domain Users
BM_1263394
WNT-DOMAIN\Domain Admins
BM_1263395
WNT-DOMAIN\SU Users
BM_1263396
WNT-DOMAIN\Installers
BM_1263397
BUILTIN\Users
BM_1263398
BUILTIN\Administrators
BM_1263399
User is also a member of Everyone, Network Users,
BM_1263400
Authenticated Users
BM_1263401
***************
-----Original Message-----
From: Monica Lam [mailto:Monica.Lam@cosinecom.com]
Sent: Tuesday, March 06, 2001 10:29 AM
To: 'toasters(a)mathworks.com'
Subject: Is there a way to tell who is mapping specific filer cifs shares?
Hi,
We want to intermittantly capture data on which users are mapping
which cifs shares off of our filers. Any one familiar with a command
line way of doing this, either from NT or solaris or the Network Appliance
itself?
(The information shows up in the NT server manager, but it is not very
useful
in terms of capturing trends...)
Thanks!