NETGEAR is aware of a growing number of phone and online scams. To learn how to stay safe click here.
Forum Discussion
Solved
ReadyNas 4312 - Setup Auditing on File shares
Hello All,
I have a few readyNas 4312's. Two have file shares on them. I'd like to enable folder/file auditing to see when a users delete a folder.
On Windows servers I am able to enable auditing to see what/who/when deleted a file or a repository... Is there an option to enable auditing on the ReadyNas?
jamesMDC wrote:
On Windows servers I am able to enable auditing to see what/who/when deleted a file or a repository... Is there an option to enable auditing on the ReadyNas?
There is an audit function, outlined here:
Also, pages 246-248 of the manual here:
3 Replies
Replies have been turned off for this discussion
jamesMDC wrote:
On Windows servers I am able to enable auditing to see what/who/when deleted a file or a repository... Is there an option to enable auditing on the ReadyNas?
There is an audit function, outlined here:
Also, pages 246-248 of the manual here:
Pages 246-248 is what I needed. Audit Setup for the shares is now enabled
Mar 02, 2023 10:59:43 AM - System: Service protocol Audit is enabled.
Tested by creating a file, a folder within said shares and letting them sit a few minutes. Then deleted them.
Under System > Logs > Audit > no logs are displayed for any action or protocol.
ReadyNas 4312
Firmware 6.10.4 Hotfix 1 (latest build)
First off, 6.10.4 is not the latest build, 6.10.8 is. When you turn on logging, you must select a location for the log archive, or the Apply button is not activated (but see below for more on this). Once you are sure you actually have logging enabled, make sure you've hit the Refresh button to see the latest actions.
The log function works in 6.8.10. I don't know about 6.10.4.
Here are some things I think could be improved (in some cases, maybe just with better documentation):
- It would be more useful if it differentiated between creation of a new file and modification of an existing one. Both are simply a write.
- Since any access by Windows shows up as a read, which will happen with every file in it when you simply open a folder, the log is going to fill up fast if you include read access auditing.
- Automatic admin logout seems to be logged as a login failure, with the re-login not logged at all.
- While you have to select a folder for the log archive, there is no indication of when an archive occurs. The log itself is ./.apps/.audit/audit_log.sq3. If you select to clear the log, it says it's going to archive it. But I've not run it long enough to see if automatic archives are created when it reaches the max size selected.
- Once enabled, it's not obvious that disabling or changing the initial options is now done from the Settings page..
NETGEAR Academy
Boost your skills with the Netgear Academy - Get trained, certified and stay ahead with the latest Netgear technology!
Join Us!
