Detecting MP3 Access over CIFS



We recently found that users storing and accessing MP3s on our CIFS server was slowing down performance. We needed to be able to detect when this was happening, what files were being accessed, and which users were doing it.

The following Trigger accomplishes this. Slight modifications can be made to detect access to other file types.

For the event, select CIFS_REQUEST.

var resource = CIFS.resource;
var user = CIFS.user;

if (!CIFS.isCommandRead) exit();
if (resource === null || user === null) exit();

if (!(/\.mp3$/i.test(resource))) exit();
Network.metricAddCount("mp3_file", 1);
Network.metricAddDetailCount("mp3_file_detail", user + " : " + resource, 1);

Once this has been added, you can create a Custom Page to display the data. The following screenshots show how this is done: