Hello, I have been looking for last few months for a good method of auditing access to files by my users. I use a SuSE Linux (presently 7.2) system with Samba and Netatalk as a file server. What I really need is the ability to say that at 3:32 PM on March 12th, user Debbie accessed the file /path/to/some/file/here. I have looked at Snare but on my test machine (which is a Single processor Celeron 333 instead of my production servers which are Dual Xeons), it makes the machine unusably slow. While I realize that a Celeron 333 is a far cry from a Dual Xeon, the Xeons have far more users then the test server, which has a single user. I have also looked at modifying the audit module which ships with Samba so that rather then print to syslog, it stores information into a Postgresql Database. This has two problems. The first being that the VFS interface to Samba has not been stabilized. The second being that it does not audit my Macs. I have looked at Tripwire, but that seems to really be geared towards static files and detecting changes that should not have happened rather then just logging accesses. Another problem I've seen with Snare is that it will most likely log file accesses when my backup program is running which will add 50-60,000 entries to the log file. That is a very bad thing as the log file will grow way too fast. Thank you for any suggestions you may have. Bill Miller Jr. jrmiller@cbnlottery.com