[Samba] Interpreting Samba Logs
Calderon, Willy (NIH/NINDS) [C]
calderow at ninds.nih.gov
Fri Dec 5 15:49:54 GMT 2008
I am attempting to read the log files for a particular machine that is
accessing our server. The smb.conf global property has set up the log
level = 2 and each machine has a file which illustrates what they are
accessing. The following is a snippet of the log and I wanted to know if
anyone could 100% verify whether the user is COPYING the data to a local
drive. As you can see, the users has opened/closed a directory and files
within a couple of seconds. There are thousands of lines like this and I
want to be sure what this means.
<snippet>
johnsonc opened file johnsonc/My Documents/Articles, SL, Ha/Diaz NP
rojo/ongoing ischemia in setting of amyloid CK.doc read=Yes write=No
(numopen=11)
[2006/11/25 10:46:36, 0] smbd/nttrans.c:call_nt_transact_ioctl(2463)
call_nt_transact_ioctl(0x9005c): Currently not implemented.
[2006/11/25 10:46:36, 2] smbd/close.c:close_normal_file(406)
johnsonc closed file johnsonc/My Documents/Articles, SL, Ha/Diaz NP
rojo/ongoing ischemia in setting of amyloid CK.doc (numopen=10)
NT_STATUS_OK
[2006/11/25 10:46:36, 2] smbd/open.c:open_file(391)
johnsonc opened file johnsonc/My Documents/Articles, SL, Ha/Diaz NP
rojo/ongoing ischemia in setting of amyloid CK.doc read=Yes write=No
(numopen=11)
[2006/11/25 10:46:36, 2] smbd/close.c:close_normal_file(406)
johnsonc closed file johnsonc/My Documents/Articles, SL, Ha/Diaz NP
rojo/ongoing ischemia in setting of amyloid CK.doc (numopen=10)
NT_STATUS_OK
[2006/11/25 10:46:36, 2] smbd/open.c:open_file(391)
johnsonc opened file johnsonc/My Documents/Articles, SL, Ha/Diaz NP
rojo/ongoing ischemia in setting of amyloid CK.doc read=Yes write=No
(numopen=11)
[2006/11/25 10:46:36, 2] smbd/open.c:open_file(391)
johnsonc opened file johnsonc/My Documents/Articles, SL, Ha/Diaz NP
rojo/DR Lol 31.doc read=Yes write=No (numopen=12)
[2006/11/25 10:46:36, 2] smbd/close.c:close_normal_file(406)
johnsonc closed file johnsonc/My Documents/Articles, SL, Ha/Diaz NP
rojo/DR Lol 31.doc (numopen=11) NT_STATUS_OK
[2006/11/25 10:46:36, 2] smbd/open.c:open_file(391)
johnsonc opened file johnsonc/My Documents/Articles, SL, Ha/Diaz NP
rojo/DR Lol 31.doc read=Yes write=No (numopen=12)
[2006/11/25 10:46:36, 2] smbd/close.c:close_normal_file(406)
johnsonc closed file johnsonc/My Documents/Articles, SL, Ha/Diaz NP
rojo/DR Lol 31.doc (numopen=11) NT_STATUS_OK
[2006/11/25 10:46:36, 2] smbd/open.c:open_file(391)
johnsonc opened file johnsonc/My Documents/Articles, SL, Ha/Diaz NP
rojo/DR Lol 31.doc read=Yes write=No (numopen=12)
[2006/11/25 10:46:36, 2] smbd/open.c:open_file(391)
johnsonc opened file johnsonc/My Documents/Articles, SL, Ha/Diaz NP
rojo/DR Lol 31 CK.doc read=Yes write=No (numopen=13)
[2006/11/25 10:46:36, 2] smbd/close.c:close_normal_file(406)
johnsonc closed file johnsonc/My Documents/Articles, SL, Ha/Diaz NP
rojo/DR Lol 31 CK.doc (numopen=12) NT_STATUS_OK
[2006/11/25 10:46:36, 2] smbd/open.c:open_file(391)
johnsonc opened file johnsonc/My Documents/Articles, SL, Ha/Diaz NP
rojo/DR Lol 31 CK.doc read=Yes write=No (numopen=13)
[2006/11/25 10:46:36, 2] smbd/close.c:close_normal_file(406)
johnsonc closed file johnsonc/My Documents/Articles, SL, Ha/Diaz NP
rojo/DR Lol 31 CK.doc (numopen=12) NT_STATUS_OK
[2006/11/25 10:46:36, 2] smbd/open.c:open_file(391)
johnsonc opened file johnsonc/My Documents/Articles, SL, Ha/Diaz NP
rojo/DR Lol 31 CK.doc read=Yes write=No (numopen=13)
[2006/11/25 10:46:36, 2] smbd/open.c:open_file(391)
johnsonc opened file johnsonc/My Documents/Articles, SL, Ha/Diaz NP
rojo/~$AA Lol 31 CK.doc read=Yes write=No (numopen=14)
[2006/11/25 10:46:36, 2] smbd/close.c:close_normal_file(406)
johnsonc closed file johnsonc/My Documents/Articles, SL, Ha/Diaz NP
rojo/~$AA Lol 31 CK.doc (numopen=13) NT_STATUS_OK
[2006/11/25 10:46:36, 2] smbd/open.c:open_file(391)
johnsonc opened file johnsonc/My Documents/Articles, SL, Ha/Diaz NP
rojo/~$AA Lol 31 CK.doc read=Yes write=No (numopen=14)
[2006/11/25 10:46:36, 2] smbd/close.c:close_normal_file(406)
johnsonc closed file johnsonc/My Documents/Articles, SL, Ha/Diaz NP
rojo/~$AA Lol 31 CK.doc (numopen=13) NT_STATUS_OK
[2006/11/25 10:46:36, 2] smbd/open.c:open_file(391)
johnsonc opened file johnsonc/My Documents/Articles, SL, Ha/Diaz NP
rojo/~$AA Lol 31 CK.doc read=Yes write=No (numopen=14)
[2006/11/25 10:46:36, 2] smbd/open.c:open_file(391)
johnsonc opened file johnsonc/My Documents/Articles, SL, Ha/Diaz NP
rojo/bDWI9.jpg read=Yes write=No (numopen=15)
[2006/11/25 10:46:36, 2] smbd/open.c:open_file(391)
johnsonc opened file johnsonc/My Documents/Articles, SL, Ha/Diaz NP
rojo/bDWI20.jpg read=Yes write=No (numopen=16)
[2006/11/25 10:46:36, 2] smbd/open.c:open_file(391)
johnsonc opened file johnsonc/My Documents/Articles, SL, Ha/Diaz NP
rojo/bGRE9.jpg read=Yes write=No (numopen=17)
[2006/11/25 10:46:36, 2] smbd/open.c:open_file(391)
johnsonc opened file johnsonc/My Documents/Articles, SL, Ha/Diaz NP
rojo/bGRE20.jpg read=Yes write=No (numopen=18)
[2006/11/25 10:46:36, 2] smbd/open.c:open_file(391)
johnsonc opened file johnsonc/My Documents/Articles, SL, Ha/Diaz NP
rojo/bFL8.jpg read=Yes write=No (numopen=19)
[2006/11/25 10:46:36, 2] smbd/open.c:open_file(391)
johnsonc opened file johnsonc/My Documents/Articles, SL, Ha/Diaz NP
rojo/bFL20.jpg read=Yes write=No (numopen=20)
[2006/11/25 10:46:36, 2] smbd/open.c:open_file(391)
johnsonc opened file johnsonc/My Documents/Articles, SL, Ha/Diaz NP
rojo/48DWI9.jpg read=Yes write=No (numopen=21)
[2006/11/25 10:46:36, 2] smbd/open.c:open_file(391)
johnsonc opened file johnsonc/My Documents/Articles, SL, Ha/Diaz NP
rojo/48DWI20.jpg read=Yes write=No (numopen=22)
[2006/11/25 10:46:36, 2] smbd/open.c:open_file(391)
johnsonc opened file johnsonc/My Documents/Articles, SL, Ha/Diaz NP
rojo/48GRE9.jpg read=Yes write=No (numopen=23)
[2006/11/25 10:46:36, 2] smbd/open.c:open_file(391)
johnsonc opened file johnsonc/My Documents/Articles, SL, Ha/Diaz NP
rojo/48GRE20.jpg read=Yes write=No (numopen=24)
[2006/11/25 10:46:36, 2] smbd/open.c:open_file(391)
johnsonc opened file johnsonc/My Documents/Articles, SL, Ha/Diaz NP
rojo/48FL9.jpg read=Yes write=No (numopen=25)
[2006/11/25 10:46:36, 2] smbd/open.c:open_file(391)
johnsonc opened file johnsonc/My Documents/Articles, SL, Ha/Diaz NP
rojo/48FL20.jpg read=Yes write=No (numopen=26)
[2006/11/25 10:46:36, 2] smbd/open.c:open_file(391)
johnsonc opened file johnsonc/My Documents/Articles, SL, Ha/Diaz NP
rojo/D30DWI7.jpg read=Yes write=No (numopen=27)
[2006/11/25 10:46:36, 2] smbd/open.c:open_file(391)
johnsonc opened file johnsonc/My Documents/Articles, SL, Ha/Diaz NP
rojo/D30DWI18.jpg read=Yes write=No (numopen=28)
[2006/11/25 10:46:36, 2] smbd/open.c:open_file(391)
johnsonc opened file johnsonc/My Documents/Articles, SL, Ha/Diaz NP
rojo/D30GRE9.jpg read=Yes write=No (numopen=29)
[2006/11/25 10:46:36, 2] smbd/open.c:open_file(391)
johnsonc opened file johnsonc/My Documents/Articles, SL, Ha/Diaz NP
rojo/D30GRE20.jpg read=Yes write=No (numopen=30)
[2006/11/25 10:46:36, 2] smbd/open.c:open_file(391)
johnsonc opened file johnsonc/My Documents/Articles, SL, Ha/Diaz NP
rojo/D90DWI9.jpg read=Yes write=No (numopen=31)
[2006/11/25 10:46:36, 2] smbd/open.c:open_file(391)
johnsonc opened file johnsonc/My Documents/Articles, SL, Ha/Diaz NP
rojo/D90DWI19.jpg read=Yes write=No (numopen=32)
[2006/11/25 10:46:37, 2] smbd/open.c:open_file(391)
johnsonc opened file johnsonc/My Documents/Articles, SL, Ha/Diaz NP
rojo/D90DWI20.jpg read=Yes write=No (numopen=33)
[2006/11/25 10:46:37, 2] smbd/open.c:open_file(391)
johnsonc opened file johnsonc/My Documents/Articles, SL, Ha/Diaz NP
rojo/D90GRE9.jpg read=Yes write=No (numopen=34)
[2006/11/25 10:46:37, 2] smbd/open.c:open_file(391)
johnsonc opened file johnsonc/My Documents/Articles, SL, Ha/Diaz NP
rojo/D90GRE20.jpg read=Yes write=No (numopen=35)
[2006/11/25 10:46:37, 2] smbd/open.c:open_file(391)
johnsonc opened file johnsonc/My Documents/Articles, SL, Ha/Diaz NP
rojo/D90GRE19.jpg read=Yes write=No (numopen=36)
[2006/11/25 10:46:37, 2] smbd/open.c:open_file(391)
johnsonc opened file johnsonc/My Documents/Articles, SL, Ha/Diaz NP
rojo/D90FL8.jpg read=Yes write=No (numopen=37)
[2006/11/25 10:46:50, 2] smbd/open.c:open_file(391)
johnsonc opened file johnsonc/My Documents/Articles, SL, Ha/Diaz NP
rojo/D90FL9.jpg read=Yes write=No (numopen=38)
[2006/11/25 10:46:50, 2] smbd/open.c:open_file(391)
johnsonc opened file johnsonc/My Documents/Articles, SL, Ha/Diaz NP
rojo/D90FL19.jpg read=Yes write=No (numopen=39)
[2006/11/25 10:46:50, 2] smbd/open.c:open_file(391)
johnsonc opened file johnsonc/My Documents/Articles, SL, Ha/Diaz NP
rojo/D30ADC18.jpg read=Yes write=No (numopen=40)
[2006/11/25 10:46:50, 2] smbd/open.c:open_file(391)
johnsonc opened file johnsonc/My Documents/Articles, SL, Ha/Diaz NP
rojo/bADC20.jpg read=Yes write=No (numopen=41)
[2006/11/25 10:46:50, 2] smbd/open.c:open_file(391)
johnsonc opened file johnsonc/My Documents/Articles, SL, Ha/Diaz NP
rojo/48ADC20.jpg read=Yes write=No (numopen=42)
[2006/11/25 10:46:50, 2] smbd/open.c:open_file(391)
johnsonc opened file johnsonc/My Documents/Articles, SL, Ha/Diaz NP
rojo/D90ADC19.jpg read=Yes write=No (numopen=43)
[2006/11/25 10:46:50, 2] smbd/open.c:open_file(391)
johnsonc opened file johnsonc/My Documents/Articles, SL, Ha/Diaz NP
rojo/D30FL19.jpg read=Yes write=No (numopen=44)
[2006/11/25 10:46:50, 2] smbd/open.c:open_file(391)
johnsonc opened file johnsonc/My Documents/Articles, SL, Ha/Diaz NP
rojo/D30FL20.jpg read=Yes write=No (numopen=45)
[2006/11/25 10:46:50, 2] smbd/open.c:open_file(391)
johnsonc opened file johnsonc/My Documents/Articles, SL, Ha/Diaz NP
rojo/Argon.ppt read=Yes write=No (numopen=46)
[2006/11/25 10:46:50, 2] smbd/close.c:close_normal_file(406)
johnsonc closed file johnsonc/My Documents/Articles, SL, Ha/Diaz NP
rojo/Argon.ppt (numopen=45) NT_STATUS_OK
[2006/11/25 10:46:50, 2] smbd/open.c:open_file(391)
johnsonc opened file johnsonc/My Documents/Articles, SL, Ha/Diaz NP
rojo/Argon.ppt read=Yes write=No (numopen=46)
[2006/11/25 10:46:50, 2] smbd/close.c:close_normal_file(406)
johnsonc closed file johnsonc/My Documents/Articles, SL, Ha/Diaz NP
rojo/Argon.ppt (numopen=45) NT_STATUS_OK
[2006/11/25 10:46:50, 2] smbd/open.c:open_file(391)
johnsonc opened file johnsonc/My Documents/Articles, SL, Ha/Diaz NP
rojo/Argon.ppt read=Yes write=No (numopen=46)
[2006/11/25 10:46:50, 2] smbd/open.c:open_file(391)
johnsonc opened file johnsonc/My Documents/Articles, SL, Ha/Diaz NP
rojo/NP Rojo Report CK 12-27-07.doc read=Yes write=No (numopen=47)
[2006/11/25 10:46:50, 2] smbd/close.c:close_normal_file(406)
johnsonc closed file johnsonc/My Documents/Articles, SL, Ha/Diaz NP
rojo/NP Rojo Report CK 12-27-07.doc (numopen=46) NT_STATUS_OK
[2006/11/25 10:46:50, 2] smbd/open.c:open_file(391)
johnsonc opened file johnsonc/My Documents/Articles, SL, Ha/Diaz NP
rojo/NP Rojo Report CK 12-27-07.doc read=Yes write=No (numopen=47)
[2006/11/25 10:46:50, 2] smbd/close.c:close_normal_file(406)
johnsonc closed file johnsonc/My Documents/Articles, SL, Ha/Diaz NP
rojo/NP Rojo Report CK 12-27-07.doc (numopen=46) NT_STATUS_OK
[2006/11/25 10:46:50, 2] smbd/open.c:open_file(391)
johnsonc opened file johnsonc/My Documents/Articles, SL, Ha/Diaz NP
rojo/NP Rojo Report CK 12-27-07.doc read=Yes write=No (numopen=47)
[2006/11/25 10:46:50, 2] smbd/open.c:open_file(391)
johnsonc opened file johnsonc/My Documents/Articles, SL, Ha/Diaz NP
rojo/NP Rojo Report Oy updates RM red wowzer from Dec2807.doc read=Yes
write=No (numopen=48)
[2006/11/25 10:46:50, 2] smbd/close.c:close_normal_file(406)
johnsonc closed file johnsonc/My Documents/Articles, SL, Ha/Diaz NP
rojo/NP Rojo Report Oy updates RM red wowzer from Dec2807.doc
(numopen=47) NT_STATUS_OK
[2006/11/25 10:46:50, 2] smbd/open.c:open_file(391)
johnsonc opened file johnsonc/My Documents/Articles, SL, Ha/Diaz NP
rojo/NP Rojo Report Oy updates RM red wowzer from Dec2807.doc read=Yes
write=No (numopen=48)
[2006/11/25 10:46:50, 2] smbd/close.c:close_normal_file(406)
johnsonc closed file johnsonc/My Documents/Articles, SL, Ha/Diaz NP
rojo/NP Rojo Report Oy updates RM red wowzer from Dec2807.doc
(numopen=47) NT_STATUS_OK
[2006/11/25 10:46:50, 2] smbd/open.c:open_file(391)
johnsonc opened file johnsonc/My Documents/Articles, SL, Ha/Diaz NP
rojo/NP Rojo Report Oy updates RM red wowzer from Dec2807.doc read=Yes
write=No (numopen=48)
[2006/11/25 10:46:50, 2] smbd/open.c:open_file(391)
johnsonc opened file johnsonc/My Documents/Articles, SL, Ha/Diaz NP
rojo/Dec27 CK mtg Argon.ppt read=Yes write=No (numopen=49)
[2006/11/25 10:46:50, 2] smbd/close.c:close_normal_file(406)
johnsonc closed file johnsonc/My Documents/Articles, SL, Ha/Diaz NP
rojo/Dec27 CK mtg Argon.ppt (numopen=48) NT_STATUS_OK
[2006/11/25 10:46:50, 2] smbd/open.c:open_file(391)
johnsonc opened file johnsonc/My Documents/Articles, SL, Ha/Diaz NP
rojo/Dec27 CK mtg Argon.ppt read=Yes write=No (numopen=49)
[2006/11/25 10:46:50, 2] smbd/close.c:close_normal_file(406)
johnsonc closed file johnsonc/My Documents/Articles, SL, Ha/Diaz NP
rojo/Dec27 CK mtg Argon.ppt (numopen=48) NT_STATUS_OK
[2006/11/25 10:46:50, 2] smbd/open.c:open_file(391)
johnsonc opened file johnsonc/My Documents/Articles, SL, Ha/Diaz NP
rojo/Dec27 CK mtg Argon.ppt read=Yes write=No (numopen=49)
[2006/11/25 10:46:50, 2] smbd/open.c:open_file(391)
</snippet>
More information about the samba
mailing list