[Aide] help figure out about deleted files

[Pablo Virolainen]

On Sun, 26 Mar 2006, Pablo Virolainen wrote:

> > I have a huge share using samba that people in the company have write
> > permissions to.
> > Can Aide help me figure out if some particular user deleted some files
> > from there, when and what he deleted?
> > Currently, each user needs to enter a user name/password to this share.
>
> You can use AIDE to detect that the file has been deleted in this time
> interval (between two runs of AIDE).
>
> If you want more detail information, you should be able to get that
> information from the Samba server.

And indeed you can. See
http://us5.samba.org/samba/docs/man/Samba-HOWTO-Collection/VFS.html#xtdaudit

Pablo Virolainen