Trying to see what files are being accessed

[breaker24]

I am using Redhat 7.1 with Samba. I am having a problem with one of my programs that is on the samba partition. Does anyone know of a way that I can see what files are currently being accessed. Also would be helpful if it should who was accessing them along with their IP's. Thanks

 

[ifincham]

Hi,

Probably the easiest with samba is to use swat (samba web admin tool) and click on the 'status' icon. You can set it to auto-refresh every few seconds (

http://localhost:901)

.

Active Connections
[PID] [Client] [IP address] [Date] [Kill]

Active Shares
[Share] [User] [Group] [PID] [Client] [Date]

Open Files
[PID] [Sharing] [R/W] [Oplock] [File] [Date]

If you don't have it installed just gran the samba-swat rpm --> ftp://rpmfind.net/linux/redhat/7.1/en/os/i386/RedHat/RPMS/samba-swat-2.0.7-36.i386.rpm . Download somewhere, 'cd' to that directory then do as root:

rpm -Uvh samba-swat*.rpm
/sbin/chkconfig swat on
then goto mozilla/opera/netscape and do

http://localhost:901

and login as root.

Hope this helps

 

[marsd]

Easiest without a doubt is smbstatus.

It also has some options which make it easy to specify
what info you want.

Something like this:
i=0
while :
do
i=`expr $i + 1`
echo -e "Next check: `date +opts`\n." >> /var/log/file
smbstatus -opts &>> /var/log/file
echo -e "Ending check #$i.\n" >> /var/log/file

sleep 120s
clear
done

Gives you a running (additional) log of your
smb activities: plus samba has very decent and
tunable logging facilities anyway.

 

[breaker24]

dumb question I had this running at one time but it no longer runs. It seems like it quit working about the time Auto update update samba. I have read about it and I have the command line in the inetd.conf file and rebooted the server but it still is not coming up. I am trying to access this from an internal IP. Thanks

 

[ifincham]

Hi,

If you mean swat isn't working then that's probably because inetd & inetd.conf are deprecated on Redhat 7.x as the functionality of inetd has been superceded by xinetd. All the redhat rpms have xinetd config files included and assume you are using that. To get a redhat samba-swat running you'd have to have the xinetd service active and the swat config file set such that swat is not disabled. It also defaults to allowing access only from 'localhost' although you can change that by editing /etc/xinetd.d/swat .

/sbin/chkconfig --level 345 xinetd on
/sbin/chkconfig swat on

Regards

 

[breaker24]

Sorry to be such a pain but I tried this and it didn't work. There has to be something I am doing wrong.
Thank you

 

[ifincham]

Hi,



Well firstly, is swat (xinetd) actually listening on port 901 ? If you do (as root) :



/usr/sbin/lsof -i TCP:901



You should get a response something like this :



COMMAND PID USER FD TYPE DEVICE SIZE NODE NAME

xinetd 669 root 5u IPv4 3396 TCP *:swat (LISTEN)



If there's nothing check that xinetd is active :



ps f -C xinetd



The reponse should look like :



PID TTY STAT TIME COMMAND

669 ? S 0:00 xinetd -stayalive -reuse -pidfile /var/run/xinetd.pid





Also '/usr/sbin/lsof -i TCP | grep xinetd' should show all the TCP services that xinetd is listening for.

If xinetd doesn't seem to be running do (still as root) :

/etc/rc.d/init.d/xinetd restart
immediately followed by
tail /var/log/messages

The latter should show start-up error messages...


How does it all look ?



Regards

 

[breaker24]

Ok This is what I got

Dec 14 13:06:55 localhost xinetd{2214} :

talk disabled removing
telnet disabled removing
tftp disabled removing
time disabled removing
time disabled removing
ftp disabled removing
no such internal service: swat
xinetd Version 2.3.3 started with libwrap options compiled in
Started working: 0 available services
xinetd startup succeeded


Ok I will be honest I am pretty new to all this and really don't know a whole lot I checked everthing you asked me to and here is what I got. Thanks Alot

 

[ifincham]

Hi,



By default on redhat, xinetd is configured to include all the individual files in the /etc/xinetd.d directory. So when xinetd starts it will read all of those files and, subject to the parameters contained inside, start a listener process on behalf of that service. You log is saying that the first six config files in /etc/xinetd.d had the entry 'disable=yes' and so were ignored.



However, it also seems to be saying that it did find a /etc/xinetd.d/swat file but that, presumably, there was some error in the file that caused it not to start. So, your xinetd is starting but is not listening for swat (or other services). That could be because its pointing at a missing executable or suchlike even if the syntax is correct.



Check your /etc/xinetd.d/swat file. It should look something like :



# default: off

# description: SWAT is the Samba Web Admin Tool. Use swat

# to configure your Samba server. To use SWAT,

# connect to port 901 with your favorite web browser.

service swat

{

port = 901

socket_type = stream

wait = no

only_from = localhost

user = root

server = /usr/sbin/swat

log_on_failure += USERID

disable = no

}





There was a problem in 7.0 in that you had to use '127.0.0.1' instead of 'localhost' due to a tcp_wrappers bug but that shouldn't affect 7.1 . If the file looks OK then make sure the rpm files are all still there :



rpm -V samba-swat





Regards