MONITORING user's file activity in SAMBA (2.0.7)

Andrew Bartlett abartlet at
Sat Oct 6 04:17:02 GMT 2001

Joel Hammer wrote:
> > > My goal is to figure out which client computer
> > > issued a specific file/dir deletion on the
> > > samba-server. The problem is: every client
> > > machine uses the same user name to logon to
> > > the shares (as I wrote: screwed-up-architecture).
> >
> > Fix the architecture.  Once you have done that, and users using their
> > own logins, then look into the audit vfs example module (may require
> > coding for your particular situation).
> >
> One surprising thing about logging shares.
> Even though I use a guest (ftp) for all my shares, with logging set to 3,
> the log shows the original user name opening the file but the guest user closing
> the file.

I've looked at that peice of code, and was intending to fix it at some
stage, but doing it properly required following too much of this code

Care to prepare a patch?

Andrew Bartlett

Andrew Bartlett                                 abartlet at
Samba Team member, Build Farm maintainer        abartlet at
Student Network Administrator, Hawker College   abartlet at

More information about the samba mailing list