Hi pfranz,

There is nothing native to the Isilon that identifies machine to share.

That being said, while not a guarantee, you could try:

root@isi721x-1 ~ # isi smb openfiles list -v

         ID: 60

       Path: C:\ifs

       User: root

     #Locks: 0

Permissions: read

--------------------------------------------------------------------------------

         ID: 58

       Path: C:\ifs

       User: root

     #Locks: 0

Permissions: -

This will give you a path, which you can *link* to a share , and you can assume a username, which you can use 'isi smb session list' to attempt to tie the username to a machine, but usernames -> machines (IP) is not a one-to-one

Thanks, that's exactly what I've been doing so far.  Unfortunately, we have a cluster of machines who run as Administrator reading and writing to the smb share.  It's good at least to confirm I'm not missing something obvious.

Is there any way to correlate that id to something?  Or another method by looking at the network traffic?

Hi pfranz,

There isn't a way to correlate that ID to anything that I know of in terms of figuring out which machines are accessing a share. You may be able to get more information from a packet capture, but Isilon doesn't have the stats or ability to view that directly without inferring one way or another. The inference on whom has the file open is based on open file -> user session -> [multiple] IPs.