Tracing user activity

Ok; first step is to create and send around and to require explicit acknowledgment of the site appropriate use of computers policy. Check with your legal-type folks here. Each user gets one of these.

Next step is to download and install the Common Criteria tools for Mac OS X for 10.3 and 10.4. You'll be enabling auditing, and the common criteria downloads include the audit tools and documentation.

You're probably not so interested in the Common Criteria itself. Just the tools. Particularly audit, auditreduce and praudit. You'll be looking at writes to /User, for instance.

Even though 10.4 does have ACLs, the ACL implementation doesn't appear to have a way to trigger an audit for a particular event or file access.

Somebody may know an easier way. Wading through auditing isn't going to be "fun"... Mayhap some sort of an Automator quietly connected onto the directory file(s) involved, if the target(s) of your gremlin are fairly consistent.

Hi

Apart from Mr Hoffman’s suggestions you can also enable Access logging in Server Admin. Server Admin > AFP > Settings > Logging. Its pretty obvious what the settings will do once enabled. The log will track users by their IP address. All you have to do is map the IP address to the hardware and you have your user.

You could also investigate ARD’s generate reports feature.

Tony

as far as i know, there's nothing built-in that will do what you want. the common criteria tools may do it, but i don't have any experience using them.

afp logs won't tell you much beyond file open/delete messages.

ard user history reports most likely won't give you anything useful.

in addition to using the common criteria tools, you may want to address the issue in person with everyone present. if you're a small company, that shouldn't be too difficult. in a non-threatening way, just tell people to stop making a mess.

also, if you're running server 10.4.x, you may be able to enable and tweak ACLs to prevent some of the damage you've experienced while still allowing people to work.

Hi

A good place to start would be here:

http://www.apple.com/support/manuals/macosxserver/

Specifically the File Services Admin 10.4 as well as the User Management Admin 10.4 Manuals.

In addition to these I would advise consulting Gerrit de Witt’s articles, which in my opinion are the best reference source. Start there first if you are interested in using and understanding any of the permissions models available in 10.4 Server. Click on this link as well as searching for his posts:

http://discussions.apple.com/thread.jspa?messageID=1535247

Tony