An event reporting framework for Samba

[Richard Sharpe]

On Sat, Jan 23, 2016 at 11:13 PM, Volker Lendecke
<Volker.Lendecke at sernet.de> wrote:
> On Fri, Jan 22, 2016 at 07:37:20PM -0800, Richard Sharpe wrote:
>> Hi folks,
>>
>> I am seeking feedback on an idea for an improvement in Samba.
>>
>> In modern storage environments people want analytics and Samba needs
>> to be able to provide the information requested.
>> .rts from those events.
>>
>> In general, they would like a stream of events that they will then
>> store in a database and from which they can generate interesting
>> reports.
>>
>> For example, they would like:
>>
>> 1. Info about every logon, including who, when, where.
>> 2. Info about every logoff, same as above.
>> 3. Info about every tree connect, when, what, who.
>> 4. Info about every tree disconnect, when, what, who.
>> 5. Info about every file create
>> 6. Info about every file delete, rename, change of attributes, and so on.
>>
>> From these they can generate reports about who accesses what and how
>> many files are created, etc.
>>
>> Now, some of this could be achieved today by adding event reporting
>> calls within a VFS module, not all of it can without modifying Samba.
>> Moreover, I have probably not thought of everything that people might
>> want events for. It might be easier if we had an event reporting
>> framework that users could plug into. The default behavior would be to
>> do absolutely nothing, especially if the user has not provided the
>> module.
>>
>> Does this sound like a useful thing to do?
>
> It does, of course. What about just using a new "audit" or
> "event" debug class? Our debug system is very flexible these
> days, and we can plug in quite a lot into it.

That is an interesting idea ... let me think about over the next week or so.

-- 
Regards,
Richard Sharpe
(何以解憂？唯有杜康。--曹操)