samba log

[Andrew Bartlett]

Richard Sharpe wrote:
> 
> Hi Jim,
> 
> Jim Buckley wrote:
> 
> >I need to identify when a user deletes a file on the samba server. I
> >plan to grep the logs, but could someone please identify what smb would
> >produce when a file is removed?
> >
> Well, if you increase the log level you will get all sorts of
> information, but the message will depend on how the file is deleted, ie
> with a delete or delete on close.
> 
> However, since it all seems to go through vfswrap_unlink in
> smbd/vfswrap.c, you could add a DEBUG message there that identifies the
> user (since you have the connection structure) and the path.

Watch out!  The user in the connection structure doesn't alway apply,
particularly on windows terminal server machines.  The problem is that
multiple vuids can use the same tid, rendering the tid's idea of an uid
meaningless.  The connection structure only knows the user that opened
it, not who is using it at the moment :-(

Andrew Bartlett

-- 
Andrew Bartlett                                 abartlet at pcug.org.au
Manager, Authentication Subsystems, Samba Team  abartlet at samba.org
Student Network Administrator, Hawker College   abartlet at hawkerc.net
http://samba.org     http://build.samba.org     http://hawkerc.net