SAMBA Log files and reading them
 

Good Day

I am running a Samba file server for a large organization. The log level has been increased to "3", what I want to do is to be able to monitor who is accessing what files and when they do it.

I need to be able to check details of which user accessed file and so on....The samba log files dont appear to do this.

Is there software out there that will enable me to do this??

Cheers

logs
 

The log files contain some references to users connecting to a samba share and you would need to write a sed or awk script to extract the information. To test, log in from machine1 on a Windows client under "user1" say and then grep user1 log.machine1 and you'll find reference to the login. Log level 3 is probably a bit high and there are heaps of "stuff" that is not very useful and it fills your server with log dross. Yu might try lowering it to 2 and see if the test still works for you.

Alternatively you can examine /var/log/messages file for samba references. In the past I have notice samba connections being logged but today I notice I'm only getting samba data base errors.

There are also all the network monitoring commands that can give you information such as netstat, mtr and tcpdump or ethereal. These also have practical limitations but are interesting to play with.