Andrei,
I've been dealing with *nix for the last 18 years and have limited Windows experience. Please excuse my noob questions.
How would the file auditing get set up and work? They don't access this share from a single system.
I don't have access to the share they are looking at so I can't do anything on my VM. Would this have to be turned on for all of them, or just on one?
Thanks,
Jeff
On Fri, Sep 18, 2015 at 1:25 AM, Borzenkov, Andrei < andrei.borzenkov@ts.fujitsu.com> wrote:
You should be able to enable audit for files using standard file security dialog in Windows.
With best regards
*Andre**i** Borzenkov*
Senior system engineer
FTS WEMEAI RUC RU SC TMS FOS
[image: cid:image001.gif@01CBF835.B3FEDA90]
*FUJITSU*
Zemlyanoy Val Street, 9, 105 064 Moscow, Russian Federation
Tel.: +7 495 730 62 20 ( reception)
Mob.: +7 916 678 7208
Fax: +7 495 730 62 14
E-mail: Andrei.Borzenkov@ts.fujitsu.com
Web: ru.fujitsu.com http://ts.fujitsu.com/
Company details: ts.fujitsu.com/imprint http://ts.fujitsu.com/imprint.html
This communication contains information that is confidential, proprietary in nature and/or privileged. It is for the exclusive use of the intended recipient(s). If you are not the intended recipient(s) or the person responsible for delivering it to the intended recipient(s), please note that any form of dissemination, distribution or copying of this communication is strictly prohibited and may be unlawful. If you have received this communication in error, please immediately notify the sender and delete the original communication. Thank you for your cooperation.
Please be advised that neither Fujitsu, its affiliates, its employees or agents accept liability for any errors, omissions or damages caused by delays of receipt or by any virus infection in this message or its attachments, or which may otherwise arise as a result of this e-mail transmission.
*From:* toasters-bounces@teaparty.net [mailto: toasters-bounces@teaparty.net] *On Behalf Of *Jeff Cleverley *Sent:* Friday, September 18, 2015 4:25 AM *To:* Toasters@teaparty.net *Subject:* Cifs share access log
Greetings,
Is there a way to have the system log what users connect via cifs AND also show what share they connect to? This is a 7.3.2 system.
I've been trying various cifs options. I can see where it log who I am, and where I'm coming from, but not what I'm trying to access, or what share I mounted.
Some mystery deletes have been occurring so we are trying to track down who may be accessing that particular share. Ideally I want to know when they connect and disconnect at a minimum so we have an idea when they were there.
For now I just have a script checking cifs sessions and logging connections to the share to a file. I'd rather see it in messages or audit instead.
Thanks,
Jeff
--
Jeff Cleverley IT Engineer
4380 Ziegler Road
Building 1, Dock 1 Fort Collins, Colorado 80525 970-288-4611
