1

I have a few windows file servers but am slowly changing to Freenas/ZFS boxes which are working much better however I can't figure out how to audit when people change permissions to critical folders.

On windows I enable object-level auditing via group policy then pick which folders I want to audit and select "everyone" and "change permissions" under the audit tab.

The CIFS shares on the Freenas box are all windows permissions, I can query them in powershell and write some fancy scripts, or use fairly expensive programs to give me reports.. but what I want is to be notified immediately when these change.

Currently for the windows boxes I have Splunk monitoring the event logs for eventID 4760 which and it gives me a nice printout.. I just want to mirror the functionality for these remote cifs shares.

I've tried vfs_full_audit and all sorts of ways to pass through permissions to the Freenas logs but that seems like a dead end.

0

You must log in to answer this question.

Browse other questions tagged .