I have a Windows XP machine with several Samba shares. Is it possible to obtain a log of all files that have been accessed on that machine via Samba?
1 Answer
If you want to do it for security purposes, you can use auditing. However, it does not log access to samba, but to a file object (regardless whether access was local or remote).
You can enable it as:
- Go into Local Security policy
- Go to Security settings, Local policies, Audit policy, Audit object access
- Choose whether you want to audit successful file access or failed one (or both)
- For each file (or folder) you want to track you need to set auditing
- Right-click Properties, Security tab
- Go into Advanced, Auditing tab
- Add user/group that you want to audit (Everyone?)
- Check event log for traces.
P.S. You might check Microsoft's TechNet article also. It says same thing, but with pictures. :)