I have a few windows file servers but am slowly changing to Freenas/ZFS boxes which are working much better however I can't figure out how to audit when people change permissions to critical folders.
On windows I enable object-level auditing via group policy then pick which folders I want to audit and select "everyone" and "change permissions" under the audit tab.
The CIFS shares on the Freenas box are all windows permissions, I can query them in powershell and write some fancy scripts, or use fairly expensive programs to give me reports.. but what I want is to be notified immediately when these change.
Currently for the windows boxes I have Splunk monitoring the event logs for eventID 4760 which and it gives me a nice printout.. I just want to mirror the functionality for these remote cifs shares.
I've tried vfs_full_audit and all sorts of ways to pass through permissions to the Freenas logs but that seems like a dead end.