Best practise: Prevent/alert on deletion of large amount of data on company truenas

[hidavid]

Hello,

A quick search didn't show any results although I'm sure this question has been answered before.

I want to make sure that I not only have snapshots of our company Truenas Core that prevent data loss in case someone accidentaly (or on purpose) deletes files but that i also get a notification if this happens. Is there a best practise on how to do alerting or how to contain possible actions that can cause harm to our data? Ist this even possible? Thank you.

 

[winnielinnie]

You would have to create a custom script that loops every X minutes, and then if there is a negative difference beyond a certain threshold of "used now" vs "used before", you can have it send an email alert.

The script can be saved in a home directory (or somewhere you won't lose it). Name it something like "check-mass-deletion.sh".

You would add it as a Task > Post Init Script to run at startup.

The logic would go something like this:

1. Check used space (either with "df" of "zfs")
2. This will be the variable "SPACEBEFORE"
3. In X minutes check used space again
4. This will be the variable "SPACENOW"
5. If "SPACEBEFORE" is larger than "SPACENOW" by a certain threshold, send an email
6. "SPACENOW" becomes "SPACEBEFORE"
7. The script loops every X minutes starting with Step #3

Someone might know a simpler way to achieve this.