samba - Nov 2008 - file monitoring in samba

Does anyone know how can I monitor files that was being open and access in
the samba directory? If this was not possible, is there third party apps
that can help me do what I want?


-- 
Nelson Serafica

http://nelsontux.blogspot.com

Any kernel newer than 2.6.13 has a built in API called inotify that can
alert userspace apps of changes to the filesystem. The program for doing
that is called inotify-tools. You can specify what directories you want
to watch and what events you want to watch for (create, read, write,
rename, move, close, etc.).

--
Eric Robinson


-----Original Message-----
From: samba-bounces+eric.robinson=psmnv.com@lists.samba.org
[mailto:samba-bounces+eric.robinson=psmnv.com@lists.samba.org] On Behalf
Of Nelson Serafica
Sent: Wednesday, November 12, 2008 6:34 AM
To: samba@lists.samba.org
Subject: [Samba] file monitoring in samba

Does anyone know how can I monitor files that was being open and access
in the samba directory? If this was not possible, is there third party
apps that can help me do what I want?


--
Nelson Serafica

http://nelsontux.blogspot.com
--
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/listinfo/samba


Disclaimer - November 12, 2008 
This email and any files transmitted with it are confidential and intended
solely for Nelson Serafica,samba@lists.samba.org. If you are not the named
addressee you should not disseminate, distribute, copy or alter this email. Any
views or opinions presented in this email are solely those of the author and
might not represent those of . Warning: Although  has taken reasonable
precautions to ensure no viruses are present in this email, the company cannot
accept responsibility for any loss or damage arising from the use of this email
or attachments.
This disclaimer was added by Policy Patrol: http://www.policypatrol.com/

Slight correction. The program is called inotifywait and it is parts of
the inotify-tools package. 

--
Eric Robinson




Disclaimer - November 12, 2008 
This email and any files transmitted with it are confidential and intended
solely for Nelson Serafica,samba@lists.samba.org. If you are not the named
addressee you should not disseminate, distribute, copy or alter this email. Any
views or opinions presented in this email are solely those of the author and
might not represent those of . Warning: Although  has taken reasonable
precautions to ensure no viruses are present in this email, the company cannot
accept responsibility for any loss or damage arising from the use of this email
or attachments.
This disclaimer was added by Policy Patrol: http://www.policypatrol.com/

On Wed, Nov 12, 2008 at 10:34:23PM +0800, Nelson Serafica
wrote:
> Does anyone know how can I monitor files that was being open and access in
> the samba directory? If this was not possible, is there third party apps
> that can help me do what I want?
smbstatus will give you this information.

> smbstatus will give you this information.
I don't think smbstatus shows realtime filesystem activity. Beyond that,
it definitely would not show changes to the filesystem that occur from
other processes besides samba. Perhaps I misunderstood, but I thought
Nelson wanted to watch a directory for changes. To be thorough, that
must include changes that occur in other ways, such as a user just
copying a file into the directory locally.

--
Eric Robinson


Disclaimer - November 12, 2008 
This email and any files transmitted with it are confidential and intended
solely for samba@lists.samba.org. If you are not the named addressee you should
not disseminate, distribute, copy or alter this email. Any views or opinions
presented in this email are solely those of the author and might not represent
those of . Warning: Although  has taken reasonable precautions to ensure no
viruses are present in this email, the company cannot accept responsibility for
any loss or damage arising from the use of this email or attachments.
This disclaimer was added by Policy Patrol: http://www.policypatrol.com/

---- "Robinson wrote: 
>  
> > smbstatus will give you this information.
> 
> I don't think smbstatus shows realtime filesystem activity. Beyond
that,
> it definitely would not show changes to the filesystem that occur from
> other processes besides samba. Perhaps I misunderstood, but I thought
> Nelson wanted to watch a directory for changes. To be thorough, that
> must include changes that occur in other ways, such as a user just
> copying a file into the directory locally.
> 
> --
> Eric Robinson
> 
I believe that smbstatus does show realtime file access, but does not show a
history of file access.  I have been interested in this for awhile and I thing
that audit comes closest to showing a history.
The last time I tried to work with audit it only showed information for the last
session.
And the problem with both is that if someone connects and downloads copies of
say a whole directory it doesn't show that.
> 
> Disclaimer - November 12, 2008 
> This email and any files transmitted with it are confidential and intended
solely for samba@lists.samba.org. If you are not the named addressee you should
not disseminate, distribute, copy or alter this email. Any views or opinions
presented in this email are solely those of the author and might not represent
those of . Warning: Although  has taken reasonable precautions to ensure no
viruses are present in this email, the company cannot accept responsibility for
any loss or damage arising from the use of this email or attachments.
> This disclaimer was added by Policy Patrol: http://www.policypatrol.com/
> --
> To unsubscribe from this list go to the following URL and read the
> instructions:  https://lists.samba.org/mailman/listinfo/samba

> I believe that smbstatus does show realtime file access
Even so, you have the problem of tracking filesystem changes that occur
in other ways, such as scp, ftp, rsync, or local copying.

--
Eric Robinson





Disclaimer - November 12, 2008 
This email and any files transmitted with it are confidential and intended
solely for phwashington@tx.rr.com,samba@lists.samba.org. If you are not the
named addressee you should not disseminate, distribute, copy or alter this
email. Any views or opinions presented in this email are solely those of the
author and might not represent those of . Warning: Although  has taken
reasonable precautions to ensure no viruses are present in this email, the
company cannot accept responsibility for any loss or damage arising from the use
of this email or attachments.
This disclaimer was added by Policy Patrol: http://www.policypatrol.com/

Nelson Serafica wrote:
> Does anyone know how can I monitor files that was being open and access in
> the samba directory? If this was not possible, is there third party apps
> that can help me do what I want?
> 
> 
The vfs:audit module may do what you need:

http://samba.org/samba/docs/man/Samba-HOWTO-Collection/VFS.html


-- 
tkb

---- "Robinson wrote: 
> > I believe that smbstatus does show realtime file access
> 
> Even so, you have the problem of tracking filesystem changes that occur
> in other ways, such as scp, ftp, rsync, or local copying.
> 
I agree, and I went to the web site for Inotifywatch.  But this seems to be more
of a statistical tool, or that's what I see from the examples.  Which in an
of itself is powerful tool and thanks for making me awayre of it.  But the next
big question that is going to be asked is who did it.  I'll look some more
at it and see if it can answer that question,  if it can with very little
overhead, then this would almost be a mandatory tool on most enterprise
systems.
> --
> Eric Robinson
> 
> 
> 
> 
> 
> Disclaimer - November 12, 2008 
> This email and any files transmitted with it are confidential and intended
solely for phwashington@tx.rr.com,samba@lists.samba.org. If you are not the
named addressee you should not disseminate, distribute, copy or alter this
email. Any views or opinions presented in this email are solely those of the
author and might not represent those of . Warning: Although  has taken
reasonable precautions to ensure no viruses are present in this email, the
company cannot accept responsibility for any loss or damage arising from the use
of this email or attachments.
> This disclaimer was added by Policy Patrol: http://www.policypatrol.com/

Inotifywait is not a statistical tool. It produces a real-time log of
filesystem changes that includes the path to the file and the events
that were triggered (file was opened, read, changed, deleted, etc.)

--
Eric Robinson



Disclaimer - November 12, 2008 
This email and any files transmitted with it are confidential and intended
solely for samba@lists.samba.org. If you are not the named addressee you should
not disseminate, distribute, copy or alter this email. Any views or opinions
presented in this email are solely those of the author and might not represent
those of . Warning: Although  has taken reasonable precautions to ensure no
viruses are present in this email, the company cannot accept responsibility for
any loss or damage arising from the use of this email or attachments.
This disclaimer was added by Policy Patrol: http://www.policypatrol.com/