driven Posted December 21, 2018 Share Posted December 21, 2018 I've looked ... having a hard time finding this. Is there an access log on Unraid? At a minimum showing me who logged in and when? But ideally, an option to see what files were accessed? Is this even possible on unraid? Seems pretty basic, yet I can't find it. Quote Link to comment
trurl Posted December 21, 2018 Share Posted December 21, 2018 Logins to the webUI or console/ssh/telnet are in the syslog. For network file access, you can install the Active Streams plugin to see who is currently accessing what. Quote Link to comment
driven Posted December 21, 2018 Author Share Posted December 21, 2018 22 minutes ago, trurl said: Logins to the webUI or console/ssh/telnet are in the syslog. For network file access, you can install the Active Streams plugin to see who is currently accessing what. Thank you. I will check both out. Quote Link to comment
bonienl Posted December 21, 2018 Share Posted December 21, 2018 The syslog page in the GUI gives instant view to the login attempts. Uncheck all categories except 'Login'. Quote Link to comment
driven Posted December 23, 2018 Author Share Posted December 23, 2018 On 12/21/2018 at 9:22 AM, bonienl said: The syslog page in the GUI gives instant view to the login attempts. Uncheck all categories except 'Login'. Silly question: How do I "uncheck" categories. I don't seem to have checkboxes. (See screenshot) Quote Link to comment
driven Posted December 23, 2018 Author Share Posted December 23, 2018 Also interesting. If I use tail to view /var/log/syslog, no mention of ANY logins show up. Is there an option that I have to turn on? Quote Link to comment
trurl Posted December 23, 2018 Share Posted December 23, 2018 9 minutes ago, driven said: Silly question: How do I "uncheck" categories. I don't seem to have checkboxes. (See screenshot) That doesn't match my system log display or the one bonienl posted. Do you have the Enhanced Log plugin installed maybe? I'm not sure that is being maintained anymore. Is that screenshot from going to Tools - System Log or did you just click the Log at the top of the UI? 6 minutes ago, driven said: Also interesting. If I use tail to view /var/log/syslog, no mention of ANY logins show up. Is there an option that I have to turn on? Unless you use the -n option, tail only goes back to the last 10 lines. Quote Link to comment
driven Posted December 23, 2018 Author Share Posted December 23, 2018 1 minute ago, trurl said: That doesn't match my system log display or the one bonienl posted. Do you have the Enhanced Log plugin installed maybe? I'm not sure that is being maintained anymore. Is that screenshot from going to Tools - System Log or did you just click the Log at the top of the UI? Unless you use the -n option, tail only goes back to the last 10 lines. Yes, but even if I copy it to a .txt file and read it with notepad, no mention of anything except the webgui logins. Nothing about file access. Quote Link to comment
driven Posted December 23, 2018 Author Share Posted December 23, 2018 2 minutes ago, trurl said: That doesn't match my system log display or the one bonienl posted. Do you have the Enhanced Log plugin installed maybe? I'm not sure that is being maintained anymore. Is that screenshot from going to Tools - System Log or did you just click the Log at the top of the UI? Unless you use the -n option, tail only goes back to the last 10 lines. That was from the tools menu. No log related plug-ins are installed. (Just checked) I'm on unraid 6.5.1 Quote Link to comment
Squid Posted December 23, 2018 Share Posted December 23, 2018 1 minute ago, driven said: Nothing about file access. Because file access isn't logged Quote Link to comment
driven Posted December 23, 2018 Author Share Posted December 23, 2018 Just now, Squid said: Because file access isn't logged OK, makes sense. (and thank you) Going back to my original question: Is there a way to get file access logging on unraid? Quote Link to comment
bonienl Posted December 23, 2018 Share Posted December 23, 2018 55 minutes ago, driven said: Silly question: How do I "uncheck" categories. I don't seem to have checkboxes. (See screenshot) Your screenshot is not the standard Log function under Tools. Uninstall the enhanced logging plugin. Quote Link to comment
trurl Posted December 23, 2018 Share Posted December 23, 2018 51 minutes ago, driven said: OK, makes sense. (and thank you) Going back to my original question: Is there a way to get file access logging on unraid? Active Streams plugin will let you see who currently has what open. Quote Link to comment
trurl Posted December 23, 2018 Share Posted December 23, 2018 55 minutes ago, driven said: No log related plug-ins are installed. (Just checked) I'm on unraid 6.5.1 That is a pretty old version. I don't know if it was different then or not. I still think there is some chance that all those additional buttons in your screenshot is from the plugin. If you want to post your diagnostics we could probably check to see if that plugin is installed. Quote Link to comment
driven Posted December 23, 2018 Author Share Posted December 23, 2018 2 hours ago, trurl said: That is a pretty old version. I don't know if it was different then or not. I still think there is some chance that all those additional buttons in your screenshot is from the plugin. If you want to post your diagnostics we could probably check to see if that plugin is installed. I'm glad you mentioned that. I hadn't realized I was out of date. (It never showed up as an available update like it has in the past.) I just updated to 6.6. Quite different!! (and the log viewer problem went away, so I'm good there) I owe you my thanks. Now I need to get back to trying to find a file access log. I can't believe I'm the first one to look for something like this. Quote Link to comment
NotMrSavvy Posted March 12, 2020 Share Posted March 12, 2020 I realize this is a somewhat old thread, but I'm wondering if a file access log has been added since the last post was made here? I know Dynamix Active Streams can show the files that are currently being accessed, but I'm looking for something that will log when a user connected/disconnected from a Share, as well as which users credentials were used to access the share. Is there any way to display this information in the Syslog or a plugin that would log when a user accessed a share? Any help is greatly appreciated. Quote Link to comment
hamish_18 Posted April 1, 2020 Share Posted April 1, 2020 Found this thread from searching for the same thing. It'd be super nice to be able to track when a user accesses a share. in troubleshooting another issue, I was trying to determine whether a firewall rule was working correctly or not, and wanted to track on both sides. This was for blocking smb. I know it's not working as I obviously can't access the share from the local machine, but wanted to see if there was an attempt at all on unraid. Quote Link to comment
Ellis34771 Posted April 2, 2020 Share Posted April 2, 2020 21 hours ago, hamish_18 said: Found this thread from searching for the same thing. It'd be super nice to be able to track when a user accesses a share. in troubleshooting another issue, I was trying to determine whether a firewall rule was working correctly or not, and wanted to track on both sides. This was for blocking smb. I know it's not working as I obviously can't access the share from the local machine, but wanted to see if there was an attempt at all on unraid. I get that it's not in there for performance reasons, but you bring up an excellent use case. It would be great to be able to turn on an auditing feature for troubleshooting purposes. Quote Link to comment
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.
Note: Your post will require moderator approval before it will be visible.