> from time to time some of our users delete files. But none of them do > confess that they have deleted the file. I want to find at the samba > logs which user has deleted the file. I´m using the audit-vfs module > but there are only messages about opening and closing of files. Can > anybody give me a hint for using samba logs to find the users I´m > searching for?
This is not a direct answer to your question, but rather a suggestion of a different strategy that might resolve your underlying problem: At a combined middle/high school we implemented vfs-recycle, so our deleted files aren't "really" deleted but rather are moved to a network trash can (which we then regularly trim with 'find' really removing files that haven't been touched in a week). Our requests related to deleted files (why?, please access your backup, etc.) went to ZERO. Our students (who are notoriously impulsive and forgetful) don't ever ask us where a file went any more. We found the vfs-recycle strategy works incredibly well for us. We have a second backup mechanism also, but in the last couple of years it's never ever been used nor even investigated. As far as our user students are concerned, the vfs-recycle by itself takes care of all their problems. -Chuck Kollars -- To unsubscribe from this list go to the following URL and read the instructions: https://lists.samba.org/mailman/listinfo/samba
