How to collect activity information from network-attached storage (NAS) devices?

Question

My goal is to be able to generate a report about the users that have accessed a particular folder on any file share. This includes Windows file servers, Unix/Linux file servers, and NAS devices (CIFS/SMB/NFS).

• For Windows, this isn't too complicated because it has built-in functionality that supports this (see: http://blogs.splunk.com/2013/07/08/audit-file-access-and-change-in-windows).
• I'm assuming that there is similar built-in functionality for unix/linux shares.
• So this leaves the question of whether something like this is possible for NAS devices (CIFS/SMB/NFS).

I'm thinking that something like this is possible because of some tools that I see are available, such as what is available at http://www.imperva.com/products/fsc_file-activity-monitoring.html.

So my question is the following: Is it possible to collect file share activity information from NAS devices? If so, how do I collect this information? For example, if there were APIs to support this, it would be most useful.

Answer 1

Is your NAS running SAMBA? If so will the Samba log files or smbstatus command solve your need? See https://askubuntu.com/questions/89288/how-can-i-monitor-my-samba-traffic