I keep getting emails that there are 52 changes in the /homes directory, but I cannot find the way to see he actual list of files that are changed and what the change was.
I am the only user on this NAS, and did not make any changes to any files.
Any help would be appreciated.
Do you actually use the home directory ? (home is the admin accessible top folder for all homes users)
There is only my home directory under /homes, and yes, I am using my home directory /homes/user1, but not the /homes directly.
Hmm strange, should be /home/user1, as homes is (as said) the top folder.
Login via admin and check if there is any other folders in the homes directory, or if you had some changes done in your own home (exceeding the given threshold)
If none is the case, open a ticket with QNAP
I’ve checked all, no other folders and no files. All my files are in my home folder and are intact and in place. I will open the support ticket.
Why don’t you open Security Center and view the “Unusual File Activity Monitoring page” as suggested in the email?
If not you can ssh to your Qnap, go to the folder in question and use the stat command. For example the following will show you all the hidden files that have been :
%x Time of last access
%y Time of last modification
%z Time of last change
stat %w%x%y%z .*
Bacuse, the Security center does not display neither the list of files that are changed, nor the changes. The event log shows almost the same message as the email, see for yourself:
And here is the result of the stat command. I still cannot see anything from this:
Maybe I did wrong guessing the issue was in your user’s home. The alert specifically says shared folder /homes .
So you should check hidden files in /homes
I also imagine that you don’t have more users.
The other thing I have seen is that you have a .DS_Store that macOS Finder creates in every folder in the system. It could be as simple as that, because the Alert is saying from my understanding the the files changed are unusual from an average point of view. So if I don’t copy any files to my users home folder in a month and suddenly I copy 200 pictures I guess the Alert should be triggered, right?
So I don’t know how many times changes DS_Store file, I guess every time you change your view mode or change anything it will modify the files data. I am not sure because I disabled with Onyx that feature for external folders.
I haven’t checked that feature but I guess I don’t want to become crazy with false positives that is why I have Air Gapped backups.
Sorry for not answering earlier, I do not copy files back and forth every day, I do that maybe once a month or once every few months, so what was surprising to se that there is suddenly activity in the root directory (/homes) and not even my own.
And yes, I am using mac, so DS_Store is something that is everywhere 
I did open a support ticket, wrote a couple of emails back and forth with the first-line support, but they’ve escalated it, so I am awaiting for a response from them.
Hi @amnesia
Unexpected alerts can indeed occur. The current detection mechanism is based on the volume of file activity over a period of time. If the NAS has had little to no file activity during the previous period, the system will automatically lower the threshold for detecting file activity. As a result, when file activity resumes, alerts are more likely to be triggered.
In addition, to ensure normal system operations, the system itself generates a certain level of file activity. Therefore, some activity may still be observed even if the user has not performed any operations—this is considered normal behavior.
Hi @SteveKo
Understandably, there is some file activity on the NAS itself; however, it is somewhat suspicious that 52 file changes occurred during an 8-12-hour period, while there was no user activity in the /home directory.
