December 21, 20187 yr I've looked ... having a hard time finding this. Is there an access log on Unraid? At a minimum showing me who logged in and when? But ideally, an option to see what files were accessed? Is this even possible on unraid? Seems pretty basic, yet I can't find it.
December 21, 20187 yr Community Expert Logins to the webUI or console/ssh/telnet are in the syslog. For network file access, you can install the Active Streams plugin to see who is currently accessing what.
December 21, 20187 yr Author 22 minutes ago, trurl said: Logins to the webUI or console/ssh/telnet are in the syslog. For network file access, you can install the Active Streams plugin to see who is currently accessing what. Thank you. I will check both out.
December 21, 20187 yr The syslog page in the GUI gives instant view to the login attempts. Uncheck all categories except 'Login'.
December 23, 20187 yr Author On 12/21/2018 at 9:22 AM, bonienl said: The syslog page in the GUI gives instant view to the login attempts. Uncheck all categories except 'Login'. Silly question: How do I "uncheck" categories. I don't seem to have checkboxes. (See screenshot)
December 23, 20187 yr Author Also interesting. If I use tail to view /var/log/syslog, no mention of ANY logins show up. Is there an option that I have to turn on?
December 23, 20187 yr Community Expert 9 minutes ago, driven said: Silly question: How do I "uncheck" categories. I don't seem to have checkboxes. (See screenshot) That doesn't match my system log display or the one bonienl posted. Do you have the Enhanced Log plugin installed maybe? I'm not sure that is being maintained anymore. Is that screenshot from going to Tools - System Log or did you just click the Log at the top of the UI? 6 minutes ago, driven said: Also interesting. If I use tail to view /var/log/syslog, no mention of ANY logins show up. Is there an option that I have to turn on? Unless you use the -n option, tail only goes back to the last 10 lines.
December 23, 20187 yr Author 1 minute ago, trurl said: That doesn't match my system log display or the one bonienl posted. Do you have the Enhanced Log plugin installed maybe? I'm not sure that is being maintained anymore. Is that screenshot from going to Tools - System Log or did you just click the Log at the top of the UI? Unless you use the -n option, tail only goes back to the last 10 lines. Yes, but even if I copy it to a .txt file and read it with notepad, no mention of anything except the webgui logins. Nothing about file access.
December 23, 20187 yr Author 2 minutes ago, trurl said: That doesn't match my system log display or the one bonienl posted. Do you have the Enhanced Log plugin installed maybe? I'm not sure that is being maintained anymore. Is that screenshot from going to Tools - System Log or did you just click the Log at the top of the UI? Unless you use the -n option, tail only goes back to the last 10 lines. That was from the tools menu. No log related plug-ins are installed. (Just checked) I'm on unraid 6.5.1
December 23, 20187 yr 1 minute ago, driven said: Nothing about file access. Because file access isn't logged
December 23, 20187 yr Author Just now, Squid said: Because file access isn't logged OK, makes sense. (and thank you) Going back to my original question: Is there a way to get file access logging on unraid?
December 23, 20187 yr 55 minutes ago, driven said: Silly question: How do I "uncheck" categories. I don't seem to have checkboxes. (See screenshot) Your screenshot is not the standard Log function under Tools. Uninstall the enhanced logging plugin.
December 23, 20187 yr Community Expert 51 minutes ago, driven said: OK, makes sense. (and thank you) Going back to my original question: Is there a way to get file access logging on unraid? Active Streams plugin will let you see who currently has what open.
December 23, 20187 yr Community Expert 55 minutes ago, driven said: No log related plug-ins are installed. (Just checked) I'm on unraid 6.5.1 That is a pretty old version. I don't know if it was different then or not. I still think there is some chance that all those additional buttons in your screenshot is from the plugin. If you want to post your diagnostics we could probably check to see if that plugin is installed.
December 23, 20187 yr Author 2 hours ago, trurl said: That is a pretty old version. I don't know if it was different then or not. I still think there is some chance that all those additional buttons in your screenshot is from the plugin. If you want to post your diagnostics we could probably check to see if that plugin is installed. I'm glad you mentioned that. I hadn't realized I was out of date. (It never showed up as an available update like it has in the past.) I just updated to 6.6. Quite different!! (and the log viewer problem went away, so I'm good there) I owe you my thanks. Now I need to get back to trying to find a file access log. I can't believe I'm the first one to look for something like this.
March 12, 20206 yr I realize this is a somewhat old thread, but I'm wondering if a file access log has been added since the last post was made here? I know Dynamix Active Streams can show the files that are currently being accessed, but I'm looking for something that will log when a user connected/disconnected from a Share, as well as which users credentials were used to access the share. Is there any way to display this information in the Syslog or a plugin that would log when a user accessed a share? Any help is greatly appreciated.
April 1, 20206 yr Found this thread from searching for the same thing. It'd be super nice to be able to track when a user accesses a share. in troubleshooting another issue, I was trying to determine whether a firewall rule was working correctly or not, and wanted to track on both sides. This was for blocking smb. I know it's not working as I obviously can't access the share from the local machine, but wanted to see if there was an attempt at all on unraid.
April 2, 20206 yr 21 hours ago, hamish_18 said: Found this thread from searching for the same thing. It'd be super nice to be able to track when a user accesses a share. in troubleshooting another issue, I was trying to determine whether a firewall rule was working correctly or not, and wanted to track on both sides. This was for blocking smb. I know it's not working as I obviously can't access the share from the local machine, but wanted to see if there was an attempt at all on unraid. I get that it's not in there for performance reasons, but you bring up an excellent use case. It would be great to be able to turn on an auditing feature for troubleshooting purposes.
Archived
This topic is now archived and is closed to further replies.