Originally Posted By: Hal Itosis
Interestingly enough, i don't find any files with the string "AppleFileServiceAccess" in their name on any of my client machines (some of which are acting as file servers).

I have /Library/Logs/AppleFileService/AppleFileServiceError.log on my machine. Its entire content consists of:
Code:
!!Log File Created On: 6/8/2006 20:37:19 158:4:1 GMT
20/Jun/2006:19:06:53 -0800: Server shut down.
20/Jun/2006:19:09:10 -0800: Server shut down.
06/Oct/2009:21:57:25 -0800: Server shut down.
06/Oct/2009:22:25:52 -0800: Server shut down.
01/Dec/2009:12:35:13 -0800: Server shut down.
22/Jan/2010:03:38:48 -0800: Server shut down.
25/Jan/2010:13:44:42 -0800: Server shut down.
14/Feb/2010:19:35:39 -0800: Server shut down.
10/Mar/2010:13:29:36 -0800: Server shut down.
07/Apr/2010:15:05:16 -0800: Server shut down.
24/Apr/2010:19:44:47 -0800: Server shut down.
19/May/2010:12:09:51 -0800: Server shut down.
21/May/2010:09:51:04 -0800: Server shut down.
13/Jul/2010:19:49:15 -0800: Server shut down.
01/Aug/2010:16:11:04 -0800: Server shut down.
30/Nov/2010:11:21:01 -0800: Server shut down.
30/Nov/2010:12:00:19 -0800: Server shut down.
12/Dec/2010:14:28:10 -0800: Server shut down.

The file creation date corresponds roughly with the purchase date of the machine, at which time it was running 10.4.6. The last line was added today, (now running 10.6.5) after logging on (using AFP file sharing) from another machine to see what would be logged. From the other machine I duplicated a file, deleted a file, and deleted a folder containing several files. The only log message from the session came when I unmounted the shared volume.

Apparently I don't use AFP a lot, at least not in that direction. I usually copy files using scp, or AFP in the other direction.

I wonder if the OP has changed the log level, so that it's saving debugging messages that would normally be discarded. It might be interesting to see the output from
Code:
cat /etc/syslog.conf


That's the first half of the puzzle: why are these messages being logged?
The second half is: what do they mean?

I think the answer to that is pretty obvious. Someone else in the office has used Apple File Sharing to mount the user's volume (or a shared folder on it), with sufficient privilege to delete files from it, and did so.

To keep them from doing it again, take away their privilege to do so. At the least, change passwords. A talk with the boss might be in order, too.