Volume - File change logging?

[ocdpfsas]

I'm just curious if there is a common way to log changes to files within a freenas volume. We've been having some accidental deletions on a large volume and I'm trying to find out who keeps doing it.

Thanks :)

 

[cyberjock]

If you enable the recycle bin feature, when the file is deleted it'll go to the .recycle/usernamethatdeletedit/folderstructureforoldfile/filename.

Also, if you enable logging on CIFS you can probably see who deleted it. That is, assuming that the cyclic logs aren't refreshed before you see who does it.

 

[ocdpfsas]

Hmm looks like this was actually a repost unfortunately. (http://forums.freenas.org/threads/how-to-log-cifs-activity.13357/)

According to the ticket, it looks like you can't log it... Am I missing something? I noticed there's a log-level option for CFS, any idea where the log file is stored?

Thanks so much for your help!

 

[cyberjock]

logs are all in /var/logs.

Any reason you don't use the recycle bin feature of CIFS? It's handy for those "accidental" deletes that come up from time to time.

 

[ocdpfsas]

Yeah I looked through /var/logs. Couldn't find anything for CIFS or any logs with my users in them.

I already have backups of the NAS so I'm not worried about restoring stuff that's deleted, I just want to know who keeps deleting important stuff.

 

[cyberjock]

I already have backups of the NAS so I'm not worried about restoring stuff that's deleted, I just want to know who keeps deleting important stuff.

So again I'll ask.. why not enable the recycle bin? When a file is deleted you go find the file and the file path will tell you who deleted it. Sure sounds like it will tell you who did it to me...

 

[ocdpfsas]

Sorry I must be confused about something. Say I have a shared directory named "Engineering" which 45 people access on a daily basis. A directory within Engineering named "PDFs" is deleted by one of the 45 users. If it's recovered via the recycle bin, the path would just be /share/Engineering/PDFs right? Is there any association with the deleting user?

Sorry for the confusion, I just want to make sure I understand. I appreciate your help, this is probably the fastest response time I've seen on a forum post :)

 

[cyberjock]

Sorry I must be confused about something. Say I have a shared directory named "Engineering" which 45 people access on a daily basis. A directory within Engineering named "PDFs" is deleted by one of the 45 users. If it's recovered via the recycle bin, the path would just be /share/Engineering/PDFs right? Is there any association with the deleting user?

Sorry for the confusion, I just want to make sure I understand. I appreciate your help, this is probably the fastest response time I've seen on a forum post :)

Nope. Look at what I put above....

 

[ocdpfsas]

Ah that's brilliant. Thank you cyberjock!

 

[cyberjock]

Ah that's brilliant. Thank you cyberjock!

;)