Well, by default, samba doesn't seem to log deletes, but there is a pretty simple way to get what you are looking for. Add the following to the share definition in /etc/samba/smb.conf that you want to watch for the deletes from:
Code:
vfs objects = extd_audit
and that will put the entries for accesses and deletes of files on the share into the logs. If you are worried about deletes removing something you don't want removed, then here's an example of what I set up to try to secure a samba share from data loss:
Code:
[myshare]
writeable = yes
path = /mnt/thisdrv/
write list = user1,user2
comment = MyShare
valid users = user1,user2
user = user1,user2
vfs objects = extd_audit recycle
The '
recycle' option puts anything deleted from the share into a Recycler folder, like the Recycle Bin in windoze.
HTH. Let us know.
