- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark
- Subscribe
- Printer Friendly Page
Re: How to identify a user's action
- Mark as New
- Bookmark
- Subscribe
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
How to identify a user's action
My network contains multiple users and I need to identify the user who created a certain folder and the other one who deleted a file. How can I find out?
- Mark as New
- Bookmark
- Subscribe
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Re: How to identify a user's action
The system does not log that sort of user activity.
Edit: If this is an ongoing need (vs. forensics on something that has already been done), here a solution that worked for one user:
- Mark as New
- Bookmark
- Subscribe
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Re: How to identify a user's action
Wouldn't the user who created a folder be the owner of that folder? Not something you can see from the GUI, but certainly visible via SSH.
Once a file is gone, I can't think of any way to figure out who deleted it.
- Mark as New
- Bookmark
- Subscribe
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Re: How to identify a user's action
@Sandshark wrote:Wouldn't the user who created a folder be the owner of that folder? Not something you can see from the GUI, but certainly visible via SSH.
Once a file is gone, I can't think of any way to figure out who deleted it.
Ok, you went there. 🙂
I had composed the following, and then held off posting for fear of opening a proverbial can of worms.
Depending on how critical is your need, it might be technically possible to figure out who created a particular folder, but only if things have been configured and used in a particular way:
If your users are connecting to the share using individual ReadyNAS user account credentials (i.e., not anonymous/guest) then a folder will be owned by the particular ReadyNAS user that created it. Because that ownership is at the underlying filesystem level, the only way (AFAIK) to determine that ownership is using SSH shell access. This generally requires some level of comfort/experience with the underlying linux OS. There is info on configuring ReadyNAS SSH access here:
Note the very serious caveats in that article, along with this warning from the ReadyNAS OS user manual:
WARNING:
If you enable SSH root access, NETGEAR might deny you technical support.
- Mark as New
- Bookmark
- Subscribe
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Re: How to identify a user's action
Download the logs from the GUI, and look at smbd.log.
Check the owner of the files.
If that doesn't bring answers, there is nothing more that you can on a ReadyNAS, afaik anyway.
- Mark as New
- Bookmark
- Subscribe
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Re: How to identify a user's action
Holy cow! I couldn't resist poking at this some more, and found the following:
On a Windows (10) client computer, mounting a SMB share using ReadyNAS user credentials, I was able to determine the owner by:
- In File Explorer, select the folder and do right-click -> Properties
- In the Properties window, click the Security tab
- (wait for spinner mouse pointer to finish)
- Click on the Advanced button
...and presto:
and on another folder:
I don't know what, if anything, particular to my configuration might be enabling this. After thinking about it a bit, it just seems like Samba is doing a pretty good job of mapping the underlying Linux ownership/permissions to Windows NTFS-style.
I was not able to get the same kind of info on a Mac connected to the SMB share.
@BrenoMachad0, maybe worth a try?
- Mark as New
- Bookmark
- Subscribe
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Re: How to identify a user's action
Does the same for me. How about that! We all learned something today.
.