Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a lion server which is accessed by multiple people. Is it possible to find out which users have accessed a file?

share|improve this question
How exactly are they accessing the server? SMB? AFP? There's no built in solution to what you're looking for… are those specific files you want to monitor, or do you want to have a general log of activity? – slhck Sep 13 '12 at 15:20
They are connecting SMB and I want to know about files that already exsist. So it's not looking hopeful then – geminiCoder Sep 13 '12 at 18:45

After researching the subject I don't believe this is possible, as you need to set up a logging program, its not built in by default. You can get the last person to have accessed the file but not previous accessors.

share|improve this answer

I'm less qualified to answer this, as I have no experience with services running on Macos, but the other answer seems to be extremely misleading, which I will attempt to rectify.

Unless I'm very much mistaken, the SMB implementation in Macos is Samba, which is also used in most Linux and BSD based operating systems. The following explanation is true for current Gentoo Linux installations of Samba, so transcribing file paths, service management commands and logging specifics is left an exercise for the padawan system administrator.

Open the smb.conf file, and change or add a the following line to the global part of the configuration:

log level = 2

Also look for this entry, it tells you where the log files end up:

log file = /var/log/samba/log.%m

(The client IP address is substituted in for the %m part.)

Save the file, and restart the Samba service. Lok at the log file for a client address (let's use the ipv4 loopback for now), /var/log/samba/log. In a unix shell, this can be done with

$ tail -f /var/log/samba/log.

If you now access the share (in a different shell) through the loopback address and get a file, this will be indicated along with the username used for the access.

$ smbclient ${whatever_options_you_need} //${sharename}
smb: \> get testfile.txt

The result in the log file should be something like this:

[2012/09/16 13:10:13.562687,  2] smbd/open.c:704(open_file)
  ${user} opened file testfile.txt read=Yes write=No (numopen=1)
[2012/09/16 13:10:13.564096,  2] smbd/close.c:696(close_normal_file)
  ${user} closed file testfile.txt (numopen=0) NT_STATUS_OK
share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .