Trace AFP transaction on Tiger server

Hello,
I’m searching a way to know who, when and what have been done on the AFP volume of our xserve on tiger server. We want to give a VPN access to some person in our company and we would like to know if somebody “take” from the server datas in big quantity or if he only use what he needs.

I tried ktrace but it did’nt gave me all the information I needed. I mean that I would like to know that at 10:00 PM on 2007/11/21, “usermachin” upload the file “truc.pdf” from the directory /root/firstdir/seconddir/

If somebody know an application that can do this, it would help me.

Thank’s in advance.

best regard from Paris