On 25Sep2006 16:01, Dan Track <dan.track@xxxxxxxxx> wrote:
| I have server that runs samba. I'm getting weird problems being
| reported where some files are being randomly being changed. I don't
| know what is changing them and reports are so irregular that I can't
| say when it happens and which file will be affected.
|
| Is there a way to monitor files and log which process opens them? I
| know there's lsof but I'm really looking for a way to log ALL files
| opened over a 24 hour period?
Try starting the samba service by hand, like this:
strace -f -e trace=open .../smbd 2>/var/log/smb.strace.out
This will produce quite alot of output.
Since samba daemons come an go a little you may want to snapshot which
daemon has which pid regularly:
while :
do
date
smbstatus
sleep 60
done >>/var/log/smb.status.log &
Then wait for damge, and backtrack: check the smb.strace.log for
accesses to the file and then match that (there is a pid in the log)
against your smbstatus log.
Be sure to put the log files somewhere with plenty of disc space.
Cheers,
--
Cameron Simpson <cs@xxxxxxxxxx> DoD#743
http://www.cskk.ezoshosting.com/cs/
Learn from others' mistakes, you won't live long enough to make them all
yourself. - a saying they tell to all new skydivers
