We use auditd to watch a system we export via CIFS. Files kept disappearing and we had to be able to track it. Turns out it was a user with a super sensitive mouse dragging folders to other folders. You just need to setup rules and you will be able to query for file accesses on that mount. <br>
<br>Dan Kulinski <br>