In 10.6 I was able to see what IP address a user logged in to using AFP or SMB and I was also able to view which user deleted which file from a share. It appears that this ability has been removed from 10.7 server. Does anyone know how I can log file deletions and tell which user did the deleting under 10.7 server?