DSM-G600, DNS-3xx and NSA-220 Hack Forum

unmesh · 2008-11-19 06:57:12

I have some directories mounted as drive letters on all the Windows PCs on my LAN so that the contents can be accessed over SMB. Is it possible to tell which of them are accessing files when I see disk activity? IP address of the client is enough information.

Is it possible to log such accesses?

Thanks.

Last edited by unmesh (2008-11-19 07:03:48)

bodbod · 2008-11-19 11:15:57

I'll crash your post for asking a similar request but the data is directly stored on the DNS-323
Is it possible to have a log telling who did access to which file at which time, etc ?
Thx

silversurfer · 2008-11-19 23:52:45

It is possible to log certain activity. Have a look at this short introduction to extd_audit.

I did a little test on my NAS but the output is pretty cryptic and I couldn't really make use of it.

unmesh · 2008-11-20 20:20:47

bodbod wrote:
I'll crash your post for asking a similar request but the data is directly stored on the DNS-323
Is it possible to have a log telling who did access to which file at which time, etc ?
Thx

I can see that I've been insufficiently clear in my original post and our questions are likely the same.

My files are also stored on the DNS-323; its just that the Windows clients are using drive-letter mounts as the access method which might be causing references to the NAS just for directory view refreshes etc.

krimb1 · 2009-01-25 18:55:41

I too am interested in such a log. Can people report any success with silversurfer's recommendation of extd_audit?

hell0 · 2009-01-26 01:14:43

works perfect for me with
[global]
syslog = 1
log level = 2

and
[every share to be monitored]
vfs objects = audit

krimb1 · 2009-01-28 05:23:56

Great man, that's awesome to know it works.

Would anyone mind explaining instructions on how to set up extd_audit for a linux newb? The documentation looks rather daunting.

krimb1 · 2009-05-13 19:39:03

Any chance in having a Wiki on installing ext_audit?

KyleK · 2009-05-15 14:30:13

You could also use smbstatus to see who's accessing which files/folders. But that only works at the time you use it; there's no logging involved.

krimb1 · 2009-05-16 02:47:39

Thanks Kyle! Smbstatus is great! I used the precompiled version from here and it worked like a charm. http://dns323.kood.org/forum/viewtopic. … 425#p27425

Might it be possible to run a script that periodically dumps the output from smbstatus to a log file using the > command? I run fun_plug off of a thumb drive so I think it wouldn't even spin the hard disks up to check...

I'm a linux newcomer and wouldn't quite know how to proceed though. Any ideas?

DSM-G600, DNS-3xx and NSA-220 Hack Forum

Announcement

#1 2008-11-19 06:57:12

Who is accessing files on the DNS-323?

#2 2008-11-19 11:15:57

Re: Who is accessing files on the DNS-323?

#3 2008-11-19 23:52:45

Re: Who is accessing files on the DNS-323?

#4 2008-11-20 20:20:47

Re: Who is accessing files on the DNS-323?

bodbod wrote:

#5 2009-01-25 18:55:41

Re: Who is accessing files on the DNS-323?

#6 2009-01-26 01:14:43

Re: Who is accessing files on the DNS-323?

#7 2009-01-28 05:23:56

Re: Who is accessing files on the DNS-323?

#8 2009-05-13 19:39:03

Re: Who is accessing files on the DNS-323?

#9 2009-05-15 14:30:13

Re: Who is accessing files on the DNS-323?

#10 2009-05-16 02:47:39

Re: Who is accessing files on the DNS-323?

Board footer