tracking file deletions

[Geoff_UK]

Hi,

First post - be gentle !

I have FreeNAS-11.0-U1 (aa82cc58d) installed in a VM for test purposes - I have a virtual disk attached and configured as a windows share. I have created 2 test accounts and can confirm that each account can map the share from windows 10 machines and can write files to it.

What I'm after is any way to determine which user deleted a file/folder.

Is this possible?

Many thanks

 

[m0nkey_]

You could enable vfs_audit under VFS Objects on your SMB share to track what happened to which file.

http://doc.freenas.org/11/sharing.html#windows-smb-shares
https://www.samba.org/samba/docs/man/manpages/vfs_audit.8.html

 

[Geoff_UK]

thanks for your response. I'm a newcomer to FreeNAS - I've looked at the links you kindly supplied, it seems as if vfs_audit doesn't track file deletions?

The following Samba VFS operations are recorded:

connect
disconnect
opendir
mkdir
rmdir
open
close
rename
unlink
chmod
fchmod
chmod_acl
fchmod_acl

sorry if I'm being dense ?

 

[m0nkey_]

Unlink is delete.

 

[Geoff_UK]

Unlink is delete.

Please forgive my ignorance.

If I enable this, how do I see the activity ?

Regards

 

[m0nkey_]

It should be stored in the syslog, so likely /var/log/messages

 

[Geoff_UK]

sorry to be a bit of a dullard, but how do I view these logs - I want to implement the FreeNAS server at work and will need to produce a report on a monthly basis to show activity.

Regards

 

[nojohnny101]

sorry to be a bit of a dullard, but how do I view these logs - I want to implement the FreeNAS server at work and will need to produce a report on a monthly basis to show activity.

Two options:
- Login to the GUI and open up the console and navigate to the above referenced location.
- Login via external application (through SSH) and the navigate to the above referenced location.

Second method is preferred because the console has a bit of a wonky reputation.

 

[Geoff_UK]

thanks for the assistance - seems a bit of "faff" to track the deletions, but I can at least see WHEN a file was deleted, but it doesn't appear to tell me WHO deleted it? I would have expected it to show the user??

Regards