Your Synology can answer the hardest question in any office — who moved that file — but only if you switched the recorder on first. Here is how, per protocol, and how to read what it keeps.
Files moved. Someone asks who. If your answer is a shrug, this page is the fix. Synology DSM can record who downloaded, uploaded, moved, renamed or deleted a file, through which protocol, and when — but the recording is off by default, and it only starts the day you switch it on. Logs cannot be back-filled; yesterday is gone.
Logging is switched on where the service lives: Control Panel → File Services. On the SMB settings enable the Transfer Log; on the FTP settings enable the FTP transfer log — that one quietly covers FTP, FTPS and SFTP activity. File Station has its own log switch in its settings. Do this today, before you need it; the first incident is a bad day to discover the recorder was off.
By default, SMB transfer logging records deletions of files and folders. In the SMB Log Settings you can add the other events — and you should select at least Move and Rename alongside Delete. Moves and renames are how tidy people hide things and how careless people lose them; deletes alone tell only half the story. Recording every read of every file is possible in busy systems but floods the log — restraint keeps the log worth reading.
Open Log Center → File Transfer and filter before you read: set the time window first, then the user or the protocol. The question is never show me everything — it is who touched this file, on this day. Log Center lets you search by keyword, so the file name is your best filter. Export to CSV or HTML when the answer has to leave the NAS — for a manager, an auditor, or your own records.
Logs rotate. On a busy server, last month's entries can age out quietly. In Log Center, set archive rules that match how long you honestly need answers — an office usually wants at least a few months — and consider sending logs to another machine or syslog server so the evidence does not live only on the box it describes. A log that overwrites itself before the audit is decoration, not evidence.
Once a month, skim three things: deletions by users who rarely delete, transfers at odd hours, and the Connection log for logins from addresses you do not recognise. You are not hunting villains — you are keeping the system honest and catching mistakes while they are still small. And when nothing looks odd, that quiet month is itself a finding worth having.
Services, users, permissions and quotas in DSM — the complete build that these logs then protect.
▶️ Watch Full VideoNo. Transfer logging is off by default and must be enabled per protocol in the File Services settings. SMB has a Transfer Log option; the FTP transfer log also covers FTPS and SFTP activity.
Only if logging was enabled then and the entries have not rotated out. SMB logging records deletions by default once enabled. If logging was off, DSM has no record — this is why enabling it today matters.
For a typical home or small office server, the cost is negligible. Very busy systems recording every event for every protocol will grow logs faster, which is a storage and review question more than a performance one.