[Samba] Samba Logs

[Calderon, Willy (NIH/NINDS) [C]]

Is there any way to confirm through the log file that users are actually
copying data off the server to their local machine versus just viewing
it? I want to be able to track how we monitor user access to the server

 

-----Original Message-----
From: Harry Jede [mailto:walk2sun at arcor.de] 
Sent: Friday, December 12, 2008 2:59 PM
To: Calderon, Willy (NIH/NINDS) [C]
Subject: Re: [Samba] Samba Logs

Am Freitag, 12. Dezember 2008 20:41 schrieben Sie:
> I've asked this question before but got no answer.  Can anyone
> confirm what these logs mean? Do they come up when someone is copying
> files off the server to their local machine? Or is the person
> simultaneously opening dozen of documents.
>
>
>
>
>
> <snippet>
>
> ...
>
>   johnsonc opened file johnsonc/My Documents/Articles, SL, Ha/Diaz NP
> rojo/ongoing ischemia in setting of amyloid CK.doc read=Yes write=No
> (numopen=11)
>
> [2006/11/25 10:46:36, 0] smbd/nttrans.c:call_nt_transact_ioctl(2463)
> call_nt_transact_ioctl(0x9005c): Currently not implemented.
a typical Windows Indexer behaviour. You should reconfigure your 
clients, so that the "indexing service" is not allowed at all, or at a 
minimum, not trying to index network shares :-)

-- 

Gruss
	Harry Jede