An event reporting framework for Samba

[Volker Lendecke]

On Fri, Jan 22, 2016 at 07:37:20PM -0800, Richard Sharpe wrote:
> Hi folks,
> 
> I am seeking feedback on an idea for an improvement in Samba.
> 
> In modern storage environments people want analytics and Samba needs
> to be able to provide the information requested.
> .rts from those events.
> 
> In general, they would like a stream of events that they will then
> store in a database and from which they can generate interesting
> reports.
> 
> For example, they would like:
> 
> 1. Info about every logon, including who, when, where.
> 2. Info about every logoff, same as above.
> 3. Info about every tree connect, when, what, who.
> 4. Info about every tree disconnect, when, what, who.
> 5. Info about every file create
> 6. Info about every file delete, rename, change of attributes, and so on.
> 
> From these they can generate reports about who accesses what and how
> many files are created, etc.
> 
> Now, some of this could be achieved today by adding event reporting
> calls within a VFS module, not all of it can without modifying Samba.
> Moreover, I have probably not thought of everything that people might
> want events for. It might be easier if we had an event reporting
> framework that users could plug into. The default behavior would be to
> do absolutely nothing, especially if the user has not provided the
> module.
> 
> Does this sound like a useful thing to do?

It does, of course. What about just using a new "audit" or
"event" debug class? Our debug system is very flexible these
days, and we can plug in quite a lot into it.

Volker

-- 
SerNet GmbH, Bahnhofsallee 1b, 37081 Göttingen
phone: +49-551-370000-0, fax: +49-551-370000-9
AG Göttingen, HRB 2816, GF: Dr. Johannes Loxen
http://www.sernet.de, mailto:kontakt at sernet.de