Is there a way to have the system log what users connect via cifs AND also show what share they connect to?  This is a 7.3.2 system.

I've been trying various cifs options.  I can see where it log who I am, and where I'm coming from, but not what I'm trying to access, or what share I mounted.

Some mystery deletes have been occurring so we are trying to track down who may be accessing that particular share.  Ideally I want to know when they connect and disconnect at a minimum so we have an idea when they were there.

For now I just have a script checking cifs sessions and logging connections to the share to a file.  I'd rather see it in messages or audit instead.

Thanks,

Jeff
--