Sorry, missed the list.
There is already an audit VFS module. I don't think it will do quite
what you want, but I think it would be a better place to start than the
standard log files.
You aren't going to prevent access once they reach some limit are you?
you are just going to email the boss or something? (I would hate to be
working on some big project, hit the limit and find myself unable to
save all my work).
Also, things like Windows' "search for words in a file" tool will
basically transfer everything to the client machine, so just remind him
that monitoring traffic alone is a poor indicator of what is going on.
Would it be possible to disable USB storage devices and CD/DVD burners
so they can't get the data onto removable media instead?
Carl Brewer wrote:>
> I've got a paranoid client who has a samba server on a small LAN who
> wants to know if and when any of his employees 'transfer' (read,
copy
> off etc) any more than a certain threshold of data a day from the
> server, I think he's worried that some employee may grab a lot of
> stuff off the server and then share it with his competition. I tried
> to explain that this wasn't a very good solution to that problem, but
> to no avail. So I'm going to try and give him what he wants. The
> only way I can think to do it is to knock up some script that parses
> smb log files and reports on them by file access and username.
>
> Before I do it, has it already been done? I don't want to re-invent a
> wheel if I can avoid it?
>
> Thankyou
>
> Carl
>
*Michael Heydon - IT Administratorr *
michaelh@jaswin.com.au <mailto:michaelh@jaswin.com.au>