We have a document on common folder (Linux as server) on a network which can be accessed by log-in users.
Is there way to track the users who really accessed (read/copy operations only) the document? We can log the users who accessed the network, but not sure if they really viewed/copied the document. How can we check this?
If the common folder is shared through SAMBA, you need to define the logging from the samba config files.
A very good example, taken from the Samba book, is here.
Here is a question, though: are you doing this to prevent document leakage? If so, what if a user views the document, leaves his workstation, and another user comes and saves a local copy? Beware of quick-and-dirty solutions to security problems. (if not, apologies - it smelled like an auditing issue to me)