I keep getting emails that there are 52 changes in the /homes directory, but I cannot find the way to see he actual list of files that are changed and what the change was.
I am the only user on this NAS, and did not make any changes to any files.
Any help would be appreciated.
Do you actually use the home directory ? (home is the admin accessible top folder for all homes users)
There is only my home directory under /homes, and yes, I am using my home directory /homes/user1, but not the /homes directly.
Hmm strange, should be /home/user1, as homes is (as said) the top folder.
Login via admin and check if there is any other folders in the homes directory, or if you had some changes done in your own home (exceeding the given threshold)
If none is the case, open a ticket with QNAP
I’ve checked all, no other folders and no files. All my files are in my home folder and are intact and in place. I will open the support ticket.
Why don’t you open Security Center and view the “Unusual File Activity Monitoring page” as suggested in the email?
If not you can ssh to your Qnap, go to the folder in question and use the stat command. For example the following will show you all the hidden files that have been :
%x Time of last access
%y Time of last modification
%z Time of last change
stat %w%x%y%z .*
Bacuse, the Security center does not display neither the list of files that are changed, nor the changes. The event log shows almost the same message as the email, see for yourself:
And here is the result of the stat command. I still cannot see anything from this:
Maybe I did wrong guessing the issue was in your user’s home. The alert specifically says shared folder /homes .
So you should check hidden files in /homes
I also imagine that you don’t have more users.
The other thing I have seen is that you have a .DS_Store that macOS Finder creates in every folder in the system. It could be as simple as that, because the Alert is saying from my understanding the the files changed are unusual from an average point of view. So if I don’t copy any files to my users home folder in a month and suddenly I copy 200 pictures I guess the Alert should be triggered, right?
So I don’t know how many times changes DS_Store file, I guess every time you change your view mode or change anything it will modify the files data. I am not sure because I disabled with Onyx that feature for external folders.
I haven’t checked that feature but I guess I don’t want to become crazy with false positives that is why I have Air Gapped backups.
