Question about SAMBA log

yuzuohong · 04-15-2003, 10:06 AM

Hi all,

I wonder whether these are some log files in SAMBA server. Since, our samba server, which is made of RedHat7.2, has a public folder. That means every user could write and read to that folder. Anyway, you know, it's not very important folder. Today I found there are lotsa virus iinfected files in one directory in that public folder. I need to know which user copied this "bomb" to our samba server. So can I know this according to some samba log file?

zuohong

Pcghost · 04-15-2003, 11:00 AM

I would start by looking at the date and time properties of the infected files to see when they were modified/created. Then go to /var/log/ and check the log files for connections at the date and time specified. Not sure if that will work but it's a start..