[PATCHES] regarding new logging

[Christof Schmitt]

On Thu, Mar 26, 2015 at 03:11:49PM +0100, Michael Adam wrote:
> Some more thoughts triggered by a discussion with Ira:
> 
> it seems that the audit vfs modules are using syslog directly.
> This is not a problem except for the illegal use of deprecated
> lp_syslog() in the extd_audit module.
> 
> Apart from lp_syslog being deprecated, this for controlling
> the behaviour of our DEBUG() system and not for controlling
> explicit use of syslog(). A module-specific parameter would
> be more appropriate here, imho.
> 
> Interestingly, a good patch was proposed in
> https://bugzilla.samba.org/show_bug.cgi?id=3518
> but it was turned down in favour of this wrong use in
> https://bugzilla.samba.org/show_bug.cgi?id=5956
> 
> :-)
> 
> But already in 2006, Volker stated in
> https://bugzilla.samba.org/show_bug.cgi?id=3518#c2
> that:
> 
>    "... ext_audit is in kind of legacy mode. We now have full_audit
>    that potentially audits _all_ entries selectively on success and
>    failure. So I'd rather like to see effort put in there."
> 
> So there are three ways to fix this illegal use of lp_syslog:
> 
> 1. Remove vfs_extd_audit altogether.
> 
> 2. Remove the calls of lp_syslog() from vfs_extd_audit.c
>    thereby making it behave like audit and full_audit.
> 
> 3. Replace the use of lp_syslog() in vfs_extd_audit by
>    a new module specific parameter.
> 
> What do people think?
> 
> I kind of favour #1, but would propose #2 as fallback
> if there is opposition to remove it, so as not to
> put too much effort in the legacy module...

I agree with the proposal. full_audit should be sufficient, so we should
remove extd_audit.

Christof