vfs_audit.c

Sevastian Foglia sevastian.foglia at yacme.com
Fri Dec 12 08:52:44 GMT 2003


On Friday 12 December 2003 05:24, Bruno Lopes de Souza Benchimol wrote:
> Im trying to rewrite audit module to suit my needs, at least now i've added
> this part to the source just to test, but it aint giving me the syslogd
> message i want.
>
> it just show me an error msg on windows (im using windows xp atm) but it
> deletes the file and nothing goes to syslog.

Did you compile the code with the module you modified?
Did you define in a share section "vfs object = module name"?

> For the moment im just trying to put that onto syslog, later i will move it
> to a file, but thats not now.
> all i want is to show the netbios name user name and ip address on syslogd
> of who did the action (delete/create/etc)
>
> Here is my modified piece of code (still ugly but it needs to work first)
>
> Thanks,
>
> static int audit_unlink(vfs_handle_struct *handle, connection_struct *conn,
> const char *path)
>
> {
>         int result;
>
>         result = SMB_VFS_NEXT_UNLINK(handle, conn, path);
>
>         syslog(audit_syslog_priority(handle), "User: %s - %s unlink %s
> %s%s\n",
>                conn->uid ,conn->client_address,
		^^^^^^^^^^^^
This is wrong because uid is an unsigned int (i think)...If you want to know 
the user name you must use conn->user.
Look at in smb.h.

>                path,
>                (result < 0) ? "failed: " : "",
>                (result < 0) ? strerror(errno) : "");
> /*      syslog(audit_syslog_priority(handle), "unlink %s %s%s\n",
>                path,
>                (result < 0) ? "failed: " : "",
>                (result < 0) ? strerror(errno) : "");
> */
>         return result;
> }

Bye Seva



More information about the samba-technical mailing list