jgiles
-
Posts
2 -
Joined
-
Last visited
Content Type
Profiles
Forums
Downloads
Store
Gallery
Bug Reports
Documentation
Landing
Posts posted by jgiles
-
-
Hi List,
So, we had someone delete some files from out server a few days ago. We were able to restore from backup, but wanted to know who the person was.
I run a standalone samba setup using CentOS and have the ability to fully audit who does what and the information goes into the logs and ultimately into the logwatch report every night.
Im not looking from such administrative granularity with unRaid, but is there a way to see who deleted these files? I looked in the log files that were present and there was little information in them.
Is there a way to turn on auditing from the gui/web page, or should we modify the config files if needed?
Thnaks!
Share Audits
in General Support (V5 and Older)
Posted
HI Rob,
Thanks for the reply ,
Ok, I didnt know about the smb-extra.conf file. I'll look into that. I looked at my server and I just have log level 2 and it gives me who accessed the files and such, but you can also do:
full_audit:success = connect unlink rmdir opendir disconnect
full_audit:failure = connect unlink rmdir opendir disconnect
unlink = delete
on each share and that will tell you who did what and when .
I will look into that.
Thanks!
Joe