File usage problem

[Cameron Simpson]

On 25Sep2006 16:01, Dan Track <dan.track at gmail.com> wrote:
| I have server that runs samba. I'm getting weird problems being
| reported where some files are being randomly being changed. I don't
| know what is changing them and reports are so irregular that I can't
| say when it happens and which file will be affected.
| 
| Is there a way to monitor files and log which process opens them? I
| know there's lsof but I'm really looking for a way to log ALL files
| opened over a 24 hour period?

Try starting the samba service by hand, like this:

  strace -f -e trace=open .../smbd 2>/var/log/smb.strace.out

This will produce quite alot of output.

Since samba daemons come an go a little you may want to snapshot which
daemon has which pid regularly:

  while :
  do
    date
    smbstatus
    sleep 60
  done >>/var/log/smb.status.log &

Then wait for damge, and backtrack: check the smb.strace.log for
accesses to the file and then match that (there is a pid in the log)
against your smbstatus log.

Be sure to put the log files somewhere with plenty of disc space.

Cheers,
-- 
Cameron Simpson <cs at zip.com.au> DoD#743
http://www.cskk.ezoshosting.com/cs/

Learn from others' mistakes, you won't live long enough to make them all
yourself.       - a saying they tell to all new skydivers