Hi,
is it possible to check smb-connections of my server? I want to see, which files are opened from which station (ip).
The command who only works local (via terminal).
Regards.
root@isau02:/data/tmp/testfeld> netstat -an| grep -iE ":139 |:445 "
tcp 0 0 0.0.0.0:139 0.0.0.0:* LISTEN
tcp 0 0 0.0.0.0:445 0.0.0.0:* LISTEN
tcp 0 0 10.10.10.86:445 11.11.11.23:3246 VERBUNDEN
I guess you will have no luck to see which files they use. I doubt you can make Samba that talkative in debug levels. But maybe check the documentation for it.
Hello zaxxon,
Thank you for your fast reply.
I found out that the command smbstatus will give information about opended connections and used files (LOCK).
I think this is the right way. But the output of smbstatus is not what I prefer. An output like this would be nice:
------------------------------------------------------------------------
IP RESOURCE TIME
192.168.1.40 /data/share/presentation.pps connected since 10m
192.168.1.52 /data/share/text.txt connected since 2m
192.168.1.60 /data/share/movies/sample.mov connected since 1h
------------------------------------------------------------------------
I think this topic should be moved in Shell Programming and Scripting.
Hope anyone can help me. 
Thanks again and best regards.
You should not only post how it should look like ie. what you want but also how the input ie. the output of smbstatus looks like because maybe not all people that want to help you have such output available.
I move your post to Shell Programming and Scripting.
@ zaxxon
Sorry for this. Here is the addition.
This is the output of smbstatus -L to list all LOCKED (opened) files:
Locked files:
Pid Uid DenyMode Access R/W Oplock SharePath Name Time
--------------------------------------------------------------------------------------------------
6482 503 DENY_NONE 0x100001 RDONLY NONE /data/share/dir01/ . Mon Dec 8 10:32:43 2008
6482 503 DENY_NONE 0x100001 RDONLY NONE /data/shares/dir01/test.mov Mon Dec 8 10:32:45 2008
Now I need the proper IP-addresses. With the Pid you can find out which IP is used. The command is smbstatus -S:
Service pid machine Connected at
-------------------------------------------------------
dir01 32380 192.168.1.65 Sun Dec 7 17:42:08 2008
dir01 32380 192.168.1.65 Sun Dec 7 05:25:44 2008
dir01 32380 192.168.1.65 Sun Dec 7 17:44:45 2008
dir01 32380 192.168.1.65 Sun Dec 7 09:38:14 2008
dir01 32380 192.168.1.65 Mon Dec 8 09:38:57 2008
dir02 4472 192.168.1.56 Sun Dec 7 18:25:39 2008
dir01 32380 192.168.1.65 Sun Dec 7 13:30:59 2008
dir02 31340 192.168.1.58 Sat Dec 6 02:06:57 2008
dir01 6482 192.168.1.100 Mon Dec 8 10:18:44 2008
dir01 32380 192.168.1.65 Sat Dec 6 09:30:13 2008
dir01 32380 192.168.1.65 Mon Dec 8 13:29:12 2008
dir02 19565 192.168.1.54 Mon Dec 1 13:41:11 2008
dir02 32380 192.168.1.65 Sat Dec 6 09:29:40 2008
dir01 32380 192.168.1.65 Sun Dec 7 17:41:18 2008
dir01 4027 192.168.1.62 Sun Dec 7 13:55:09 2008
dir02 6482 192.168.1.100 Mon Dec 8 10:09:08 2008
dir02 4027 192.168.1.62 Sun Dec 7 13:54:24 2008
dir01 32380 192.168.1.65 Sat Dec 6 13:24:46 2008
No I need a script to compare these two outputs, so that I get a list like this:
------------------------------------------------------------------------
IP RESOURCE TIME
192.168.1.40 /data/share/presentation.pps connected since ??m
192.168.1.52 /data/share/text.txt connected since ??m
192.168.1.100 /data/share/movies/test.mov connected since ??h
------------------------------------------------------------------------
It's important to weed out duplicates (users that are connected to several samba shares).
I found an article with a similar problem, but I have no idea about shell-scripts. So I hope anyone can help me an this Link is helpful.
Thanks and regards.