Hi there,
we are running a file server with OMV and roughly twenty users. Unfortunately, one of our users seem to have started a deletion process and we therefore lost couply of TB on data. Luckily, the last backup was just a few days ago, so I'm currently restoring data. In the process of figuring out what exactly happened here, I found that I unfortunately did not set any logging for samba shares so far.
In order to track all user activities regarding file handling (copy, move, erase processes), I set the SMB/CIFS log level to "full" now. This has been written to the /etc/samba/smb.conf file as well (log level = 3, syslog = 3). Log files are written for each machine (log file = /var/log/samba/log.%m). However, all these files are empty.
During any file handling process, the OMV gui itself lists all user activities under Diagnostics/Services/SMB/CIFS, giving logged users, services and locked files. Especially the latter ist what I'm interested in and what I'd like to log into the user files. Any suggestions how to do this?
Furthermore, I think that SMB/CIFS logs do not log any activities when users are connected to the server via SSH (terminal) and mount folders via SSHFS. How do I track these activities?
Thanks,
Arne