I am attempting to read the log files for a particular machine that is accessing our server. The smb.conf global property has set up the log level = 2 and each machine has a file which illustrates what they are accessing. The following is a snippet of the log and I wanted to know if anyone could 100% verify whether the user is COPYING the data to a local drive. As you can see, the users has opened/closed a directory and files within a couple of seconds. There are thousands of lines like this and I want to be sure what this means.
<snippet> johnsonc opened file johnsonc/My Documents/Articles, SL, Ha/Diaz NP rojo/ongoing ischemia in setting of amyloid CK.doc read=Yes write=No (numopen=11) [2006/11/25 10:46:36, 0] smbd/nttrans.c:call_nt_transact_ioctl(2463) call_nt_transact_ioctl(0x9005c): Currently not implemented. [2006/11/25 10:46:36, 2] smbd/close.c:close_normal_file(406) johnsonc closed file johnsonc/My Documents/Articles, SL, Ha/Diaz NP rojo/ongoing ischemia in setting of amyloid CK.doc (numopen=10) NT_STATUS_OK [2006/11/25 10:46:36, 2] smbd/open.c:open_file(391) johnsonc opened file johnsonc/My Documents/Articles, SL, Ha/Diaz NP rojo/ongoing ischemia in setting of amyloid CK.doc read=Yes write=No (numopen=11) [2006/11/25 10:46:36, 2] smbd/close.c:close_normal_file(406) johnsonc closed file johnsonc/My Documents/Articles, SL, Ha/Diaz NP rojo/ongoing ischemia in setting of amyloid CK.doc (numopen=10) NT_STATUS_OK [2006/11/25 10:46:36, 2] smbd/open.c:open_file(391) johnsonc opened file johnsonc/My Documents/Articles, SL, Ha/Diaz NP rojo/ongoing ischemia in setting of amyloid CK.doc read=Yes write=No (numopen=11) [2006/11/25 10:46:36, 2] smbd/open.c:open_file(391) johnsonc opened file johnsonc/My Documents/Articles, SL, Ha/Diaz NP rojo/DR Lol 31.doc read=Yes write=No (numopen=12) [2006/11/25 10:46:36, 2] smbd/close.c:close_normal_file(406) johnsonc closed file johnsonc/My Documents/Articles, SL, Ha/Diaz NP rojo/DR Lol 31.doc (numopen=11) NT_STATUS_OK [2006/11/25 10:46:36, 2] smbd/open.c:open_file(391) johnsonc opened file johnsonc/My Documents/Articles, SL, Ha/Diaz NP rojo/DR Lol 31.doc read=Yes write=No (numopen=12) [2006/11/25 10:46:36, 2] smbd/close.c:close_normal_file(406) johnsonc closed file johnsonc/My Documents/Articles, SL, Ha/Diaz NP rojo/DR Lol 31.doc (numopen=11) NT_STATUS_OK [2006/11/25 10:46:36, 2] smbd/open.c:open_file(391) johnsonc opened file johnsonc/My Documents/Articles, SL, Ha/Diaz NP rojo/DR Lol 31.doc read=Yes write=No (numopen=12) [2006/11/25 10:46:36, 2] smbd/open.c:open_file(391) johnsonc opened file johnsonc/My Documents/Articles, SL, Ha/Diaz NP rojo/DR Lol 31 CK.doc read=Yes write=No (numopen=13) [2006/11/25 10:46:36, 2] smbd/close.c:close_normal_file(406) johnsonc closed file johnsonc/My Documents/Articles, SL, Ha/Diaz NP rojo/DR Lol 31 CK.doc (numopen=12) NT_STATUS_OK [2006/11/25 10:46:36, 2] smbd/open.c:open_file(391) johnsonc opened file johnsonc/My Documents/Articles, SL, Ha/Diaz NP rojo/DR Lol 31 CK.doc read=Yes write=No (numopen=13) [2006/11/25 10:46:36, 2] smbd/close.c:close_normal_file(406) johnsonc closed file johnsonc/My Documents/Articles, SL, Ha/Diaz NP rojo/DR Lol 31 CK.doc (numopen=12) NT_STATUS_OK [2006/11/25 10:46:36, 2] smbd/open.c:open_file(391) johnsonc opened file johnsonc/My Documents/Articles, SL, Ha/Diaz NP rojo/DR Lol 31 CK.doc read=Yes write=No (numopen=13) [2006/11/25 10:46:36, 2] smbd/open.c:open_file(391) johnsonc opened file johnsonc/My Documents/Articles, SL, Ha/Diaz NP rojo/~$AA Lol 31 CK.doc read=Yes write=No (numopen=14) [2006/11/25 10:46:36, 2] smbd/close.c:close_normal_file(406) johnsonc closed file johnsonc/My Documents/Articles, SL, Ha/Diaz NP rojo/~$AA Lol 31 CK.doc (numopen=13) NT_STATUS_OK [2006/11/25 10:46:36, 2] smbd/open.c:open_file(391) johnsonc opened file johnsonc/My Documents/Articles, SL, Ha/Diaz NP rojo/~$AA Lol 31 CK.doc read=Yes write=No (numopen=14) [2006/11/25 10:46:36, 2] smbd/close.c:close_normal_file(406) johnsonc closed file johnsonc/My Documents/Articles, SL, Ha/Diaz NP rojo/~$AA Lol 31 CK.doc (numopen=13) NT_STATUS_OK [2006/11/25 10:46:36, 2] smbd/open.c:open_file(391) johnsonc opened file johnsonc/My Documents/Articles, SL, Ha/Diaz NP rojo/~$AA Lol 31 CK.doc read=Yes write=No (numopen=14) [2006/11/25 10:46:36, 2] smbd/open.c:open_file(391) johnsonc opened file johnsonc/My Documents/Articles, SL, Ha/Diaz NP rojo/bDWI9.jpg read=Yes write=No (numopen=15) [2006/11/25 10:46:36, 2] smbd/open.c:open_file(391) johnsonc opened file johnsonc/My Documents/Articles, SL, Ha/Diaz NP rojo/bDWI20.jpg read=Yes write=No (numopen=16) [2006/11/25 10:46:36, 2] smbd/open.c:open_file(391) johnsonc opened file johnsonc/My Documents/Articles, SL, Ha/Diaz NP rojo/bGRE9.jpg read=Yes write=No (numopen=17) [2006/11/25 10:46:36, 2] smbd/open.c:open_file(391) johnsonc opened file johnsonc/My Documents/Articles, SL, Ha/Diaz NP rojo/bGRE20.jpg read=Yes write=No (numopen=18) [2006/11/25 10:46:36, 2] smbd/open.c:open_file(391) johnsonc opened file johnsonc/My Documents/Articles, SL, Ha/Diaz NP rojo/bFL8.jpg read=Yes write=No (numopen=19) [2006/11/25 10:46:36, 2] smbd/open.c:open_file(391) johnsonc opened file johnsonc/My Documents/Articles, SL, Ha/Diaz NP rojo/bFL20.jpg read=Yes write=No (numopen=20) [2006/11/25 10:46:36, 2] smbd/open.c:open_file(391) johnsonc opened file johnsonc/My Documents/Articles, SL, Ha/Diaz NP rojo/48DWI9.jpg read=Yes write=No (numopen=21) [2006/11/25 10:46:36, 2] smbd/open.c:open_file(391) johnsonc opened file johnsonc/My Documents/Articles, SL, Ha/Diaz NP rojo/48DWI20.jpg read=Yes write=No (numopen=22) [2006/11/25 10:46:36, 2] smbd/open.c:open_file(391) johnsonc opened file johnsonc/My Documents/Articles, SL, Ha/Diaz NP rojo/48GRE9.jpg read=Yes write=No (numopen=23) [2006/11/25 10:46:36, 2] smbd/open.c:open_file(391) johnsonc opened file johnsonc/My Documents/Articles, SL, Ha/Diaz NP rojo/48GRE20.jpg read=Yes write=No (numopen=24) [2006/11/25 10:46:36, 2] smbd/open.c:open_file(391) johnsonc opened file johnsonc/My Documents/Articles, SL, Ha/Diaz NP rojo/48FL9.jpg read=Yes write=No (numopen=25) [2006/11/25 10:46:36, 2] smbd/open.c:open_file(391) johnsonc opened file johnsonc/My Documents/Articles, SL, Ha/Diaz NP rojo/48FL20.jpg read=Yes write=No (numopen=26) [2006/11/25 10:46:36, 2] smbd/open.c:open_file(391) johnsonc opened file johnsonc/My Documents/Articles, SL, Ha/Diaz NP rojo/D30DWI7.jpg read=Yes write=No (numopen=27) [2006/11/25 10:46:36, 2] smbd/open.c:open_file(391) johnsonc opened file johnsonc/My Documents/Articles, SL, Ha/Diaz NP rojo/D30DWI18.jpg read=Yes write=No (numopen=28) [2006/11/25 10:46:36, 2] smbd/open.c:open_file(391) johnsonc opened file johnsonc/My Documents/Articles, SL, Ha/Diaz NP rojo/D30GRE9.jpg read=Yes write=No (numopen=29) [2006/11/25 10:46:36, 2] smbd/open.c:open_file(391) johnsonc opened file johnsonc/My Documents/Articles, SL, Ha/Diaz NP rojo/D30GRE20.jpg read=Yes write=No (numopen=30) [2006/11/25 10:46:36, 2] smbd/open.c:open_file(391) johnsonc opened file johnsonc/My Documents/Articles, SL, Ha/Diaz NP rojo/D90DWI9.jpg read=Yes write=No (numopen=31) [2006/11/25 10:46:36, 2] smbd/open.c:open_file(391) johnsonc opened file johnsonc/My Documents/Articles, SL, Ha/Diaz NP rojo/D90DWI19.jpg read=Yes write=No (numopen=32) [2006/11/25 10:46:37, 2] smbd/open.c:open_file(391) johnsonc opened file johnsonc/My Documents/Articles, SL, Ha/Diaz NP rojo/D90DWI20.jpg read=Yes write=No (numopen=33) [2006/11/25 10:46:37, 2] smbd/open.c:open_file(391) johnsonc opened file johnsonc/My Documents/Articles, SL, Ha/Diaz NP rojo/D90GRE9.jpg read=Yes write=No (numopen=34) [2006/11/25 10:46:37, 2] smbd/open.c:open_file(391) johnsonc opened file johnsonc/My Documents/Articles, SL, Ha/Diaz NP rojo/D90GRE20.jpg read=Yes write=No (numopen=35) [2006/11/25 10:46:37, 2] smbd/open.c:open_file(391) johnsonc opened file johnsonc/My Documents/Articles, SL, Ha/Diaz NP rojo/D90GRE19.jpg read=Yes write=No (numopen=36) [2006/11/25 10:46:37, 2] smbd/open.c:open_file(391) johnsonc opened file johnsonc/My Documents/Articles, SL, Ha/Diaz NP rojo/D90FL8.jpg read=Yes write=No (numopen=37) [2006/11/25 10:46:50, 2] smbd/open.c:open_file(391) johnsonc opened file johnsonc/My Documents/Articles, SL, Ha/Diaz NP rojo/D90FL9.jpg read=Yes write=No (numopen=38) [2006/11/25 10:46:50, 2] smbd/open.c:open_file(391) johnsonc opened file johnsonc/My Documents/Articles, SL, Ha/Diaz NP rojo/D90FL19.jpg read=Yes write=No (numopen=39) [2006/11/25 10:46:50, 2] smbd/open.c:open_file(391) johnsonc opened file johnsonc/My Documents/Articles, SL, Ha/Diaz NP rojo/D30ADC18.jpg read=Yes write=No (numopen=40) [2006/11/25 10:46:50, 2] smbd/open.c:open_file(391) johnsonc opened file johnsonc/My Documents/Articles, SL, Ha/Diaz NP rojo/bADC20.jpg read=Yes write=No (numopen=41) [2006/11/25 10:46:50, 2] smbd/open.c:open_file(391) johnsonc opened file johnsonc/My Documents/Articles, SL, Ha/Diaz NP rojo/48ADC20.jpg read=Yes write=No (numopen=42) [2006/11/25 10:46:50, 2] smbd/open.c:open_file(391) johnsonc opened file johnsonc/My Documents/Articles, SL, Ha/Diaz NP rojo/D90ADC19.jpg read=Yes write=No (numopen=43) [2006/11/25 10:46:50, 2] smbd/open.c:open_file(391) johnsonc opened file johnsonc/My Documents/Articles, SL, Ha/Diaz NP rojo/D30FL19.jpg read=Yes write=No (numopen=44) [2006/11/25 10:46:50, 2] smbd/open.c:open_file(391) johnsonc opened file johnsonc/My Documents/Articles, SL, Ha/Diaz NP rojo/D30FL20.jpg read=Yes write=No (numopen=45) [2006/11/25 10:46:50, 2] smbd/open.c:open_file(391) johnsonc opened file johnsonc/My Documents/Articles, SL, Ha/Diaz NP rojo/Argon.ppt read=Yes write=No (numopen=46) [2006/11/25 10:46:50, 2] smbd/close.c:close_normal_file(406) johnsonc closed file johnsonc/My Documents/Articles, SL, Ha/Diaz NP rojo/Argon.ppt (numopen=45) NT_STATUS_OK [2006/11/25 10:46:50, 2] smbd/open.c:open_file(391) johnsonc opened file johnsonc/My Documents/Articles, SL, Ha/Diaz NP rojo/Argon.ppt read=Yes write=No (numopen=46) [2006/11/25 10:46:50, 2] smbd/close.c:close_normal_file(406) johnsonc closed file johnsonc/My Documents/Articles, SL, Ha/Diaz NP rojo/Argon.ppt (numopen=45) NT_STATUS_OK [2006/11/25 10:46:50, 2] smbd/open.c:open_file(391) johnsonc opened file johnsonc/My Documents/Articles, SL, Ha/Diaz NP rojo/Argon.ppt read=Yes write=No (numopen=46) [2006/11/25 10:46:50, 2] smbd/open.c:open_file(391) johnsonc opened file johnsonc/My Documents/Articles, SL, Ha/Diaz NP rojo/NP Rojo Report CK 12-27-07.doc read=Yes write=No (numopen=47) [2006/11/25 10:46:50, 2] smbd/close.c:close_normal_file(406) johnsonc closed file johnsonc/My Documents/Articles, SL, Ha/Diaz NP rojo/NP Rojo Report CK 12-27-07.doc (numopen=46) NT_STATUS_OK [2006/11/25 10:46:50, 2] smbd/open.c:open_file(391) johnsonc opened file johnsonc/My Documents/Articles, SL, Ha/Diaz NP rojo/NP Rojo Report CK 12-27-07.doc read=Yes write=No (numopen=47) [2006/11/25 10:46:50, 2] smbd/close.c:close_normal_file(406) johnsonc closed file johnsonc/My Documents/Articles, SL, Ha/Diaz NP rojo/NP Rojo Report CK 12-27-07.doc (numopen=46) NT_STATUS_OK [2006/11/25 10:46:50, 2] smbd/open.c:open_file(391) johnsonc opened file johnsonc/My Documents/Articles, SL, Ha/Diaz NP rojo/NP Rojo Report CK 12-27-07.doc read=Yes write=No (numopen=47) [2006/11/25 10:46:50, 2] smbd/open.c:open_file(391) johnsonc opened file johnsonc/My Documents/Articles, SL, Ha/Diaz NP rojo/NP Rojo Report Oy updates RM red wowzer from Dec2807.doc read=Yes write=No (numopen=48) [2006/11/25 10:46:50, 2] smbd/close.c:close_normal_file(406) johnsonc closed file johnsonc/My Documents/Articles, SL, Ha/Diaz NP rojo/NP Rojo Report Oy updates RM red wowzer from Dec2807.doc (numopen=47) NT_STATUS_OK [2006/11/25 10:46:50, 2] smbd/open.c:open_file(391) johnsonc opened file johnsonc/My Documents/Articles, SL, Ha/Diaz NP rojo/NP Rojo Report Oy updates RM red wowzer from Dec2807.doc read=Yes write=No (numopen=48) [2006/11/25 10:46:50, 2] smbd/close.c:close_normal_file(406) johnsonc closed file johnsonc/My Documents/Articles, SL, Ha/Diaz NP rojo/NP Rojo Report Oy updates RM red wowzer from Dec2807.doc (numopen=47) NT_STATUS_OK [2006/11/25 10:46:50, 2] smbd/open.c:open_file(391) johnsonc opened file johnsonc/My Documents/Articles, SL, Ha/Diaz NP rojo/NP Rojo Report Oy updates RM red wowzer from Dec2807.doc read=Yes write=No (numopen=48) [2006/11/25 10:46:50, 2] smbd/open.c:open_file(391) johnsonc opened file johnsonc/My Documents/Articles, SL, Ha/Diaz NP rojo/Dec27 CK mtg Argon.ppt read=Yes write=No (numopen=49) [2006/11/25 10:46:50, 2] smbd/close.c:close_normal_file(406) johnsonc closed file johnsonc/My Documents/Articles, SL, Ha/Diaz NP rojo/Dec27 CK mtg Argon.ppt (numopen=48) NT_STATUS_OK [2006/11/25 10:46:50, 2] smbd/open.c:open_file(391) johnsonc opened file johnsonc/My Documents/Articles, SL, Ha/Diaz NP rojo/Dec27 CK mtg Argon.ppt read=Yes write=No (numopen=49) [2006/11/25 10:46:50, 2] smbd/close.c:close_normal_file(406) johnsonc closed file johnsonc/My Documents/Articles, SL, Ha/Diaz NP rojo/Dec27 CK mtg Argon.ppt (numopen=48) NT_STATUS_OK [2006/11/25 10:46:50, 2] smbd/open.c:open_file(391) johnsonc opened file johnsonc/My Documents/Articles, SL, Ha/Diaz NP rojo/Dec27 CK mtg Argon.ppt read=Yes write=No (numopen=49) [2006/11/25 10:46:50, 2] smbd/open.c:open_file(391) </snippet> -- To unsubscribe from this list go to the following URL and read the instructions: https://lists.samba.org/mailman/listinfo/samba
