Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

My current employer would like me to have some sort of system in place where the access to the data is being logged, this including the sysadmin. Currently we have one server that runs a CENTOS on it and the files are accessible to the users via samba shares.

My question, is there a software that can log whatever changes have been made to the files stored on the NAS via samba but also if the data is accessed locally by the sysadmin?

share|improve this question
up vote 1 down vote accepted

Yes, you can use auditd to provide a complete log of everything that gets accessed. Unfortunately, anyone with administrative access to the server could disable that logging (or manipulate the logs after the fact) to hide any malfeasance.

share|improve this answer
Looked into auditd but as you said is easy to manipulate/delete the logs. – Chris19 Aug 5 '12 at 10:13
The only way to separate out this stuff is with massively over-complicated siloisation. Tell your current employer to get over themselves. – womble Aug 6 '12 at 0:26

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.