ReadyNAS Auditing - Logs showing root user actions

[tiborszabo]

Hi guys,

I recently updated a RN316 to 6.10.1, which included long overdue file auditing logs.

We can now check who is writing and deleting which folders / files on the server. Really great to have.

I am however seeing an issue where some of the file and folder actions are attributed to a user simply named "root", with no valid username or IP address specified. They are valid delete / write actions as well.

This means that I cannot track any of those file actions, since I have no clue who "root" is. I have setup each PC / Mac in the company with their own specific user (not root), so this is a bit of a strange one...

Any ideas?

Many thanks for assistance in advance 🙂

[StephenB]

root is a built-in account (as in all linux systems).  So this is likely coming from the NAS system software (or maybe something else installed on the NAS).

Is root operating on files in the shares?  Or just in the OS partition?  Can you post a snippet of what you are seeing?

[tiborszabo]

Thanks StephenB,

Please see attached screenshot for some sample file activity from the root account.

It is acting in the main server data folder - I have erased the filenames for privacy purposes.

It also only appears during working hours when other user actions are being logged.

Any ideas?

[StephenB]

---

@tiborszabo wrote:

Any ideas?

---

Not many without the file names.

One possibility is that autodefrag is kicking in on the share(s).  Antivirus is also possible I guess.  Check to see if the files are still present.

Perhaps download the full log zip file, and look for system.log and kernel.log entries in the time window near the audits.

[tiborszabo]

Thanks StephenB.

Autodefrag only runs on the weekend, and antivirus is disabled.

The files being affected are work files - i.e. company data that is accessed by other users.

I'll try the full log option you suggested.

[StephenB]

Maybe also change the NAS admin password from the web UI (which will also change the root password).

[tiborszabo]

An update on this one guys.

I discovered that the "root" entries in my auditing logs were actually coming from Macs that were working on the NAS, where the NAS had been saved in the Mac keychain as an SMB or AFP share, but without credentials - almost like a corrupt entry in the Mac keychain.

Erasing these erroneous SMB / AFP password entries in the keychain, and then logging in again with the proper user credentials has sorted the issue out.