How to see who is using the server


Recommended Posts

I should have been more clear.. I would like to know when someone signs into the UNRAID server. I could sign into plex and look at USERS to see if someone is using plex, but I would like to see "in general" if someone is using the unraid server.

This is because sometimes I hear disks spin up and go active when I know I should be the only one on the machine and I am only working with the system and the disk it resides on.. That means ?? the only disks spinning would be the disk the system is on and the parity disk.

All shares are disk specific so when I see a disk assigned to a specific person is spinning, and that person is next to me, and not on the server, I get concerned

Link to comment

If @Tal's suggestion doesn't give you the information you want it still isn't clear what you're asking. You can type

who

at the command prompt to output a list of everyone logged into the server - usually only the root user in the case of unRAID. The thing is, most users don't "sign in" to use it so from your description of shares being disk specific it would seem that Dynamix Active Streams is exactly what you need.

Link to comment
13 minutes ago, Annie SIxgun said:

If someone else was on the server would this show me ??

 

"who" only shows users who have logged in so they have a command-line prompt.

In that case you see the account name and the IP number they connected from.

 

But "who" you will not let you see accesses over a disk share. Dynamix Active Streams helps with keeping track of open files.

 

The command "smbstatus" lets you see machines connected to Samba and any open shares.

Link to comment
5 hours ago, Annie SIxgun said:

ok Tal... I installed Dynamix Active Streams.    Does this program show activity on any program accessed, say nginx or Emby or dolphin

No.  Only file(s) being streamed.  For a full list of open files at any given time, you want the OpenFiles plugin.  But, any given server with any given docker application shows many, many open files at any time, so for something like Dolphin you would have to look for file(s) in /mnt/user.

Link to comment
10 hours ago, Annie SIxgun said:

...if  there is anyway to detect the presence of a person,  program, or device trying to use my server ?

 

What does this mean??? What do you want to see? Is it for intrusion or what is it? My Server can be accessed by many people, but NOONE of them has access to the server itself - so they CAN'T login to the server - thats not necessary at all... but what they can do is open streams to watch movies, tv-shows and listen music (over Plex) and therefor there is tautully...

Edited by Zonediver
Link to comment
11 hours ago, Annie SIxgun said:

Hi Squid, Thanks for the info. 

Do you know if  there is anyway to detect the presence of a person,  program, or device trying to use my server ?


Did you look at the "smbstatus" command I mentioned, showing connected machines and shares?

 

And the "who" command showing users having logged in to get shell access?

 

For web server accesses you can only see information if the web server is configured to log accesses.

 

If you have any other means to access the machine (through Docker etc) then any ability to see who are accessing will require knowledge of these additional programs and their abilities to log accesses.

Link to comment

I was just hoping there was some way to detect ANYONE either already on the server, server meaning  unraid,  any docker or other program residing on the unraid platform....

I am paranoid about intrusions as I have been hacked several times..

I was hoping there was a way other than digging through logs etc to find after the fact intrusions rather than the possibility of an alert of some kind in real time.

Hope that is more clear.

Link to comment

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.
Note: Your post will require moderator approval before it will be visible.

Guest
Reply to this topic...

×   Pasted as rich text.   Restore formatting

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.