[Samba] about logs
don_mccall at hp.com
Thu Feb 7 13:58:04 GMT 2002
Typically, you would get a SMBunlink request, and if you grep a level3 log
"reply_unlink", you would get the following, if the file being deleted was
reply_unlink : \btmp.out
unfortunately, the user name of the user that did the delete would be way
back in the log file at the time that they originally connected to the
server with a sesssetupandX...
you COULD set up your logging so that each log file had the name of the user
that was connected (if you aren't using terminal server to connect) by
setting log file = log.%U, so you could determine the user name by the log
name, and the files deleted by looking for 'reply_unlink'.
But depending on how much traffic is between the user and the server, and
how large you allow your log files to grow, you can always miss stuff...
In addition, there are other ways for clients and applications to request
the removal of a file, like setting the 'delete on close' flag, so in that
case the reply_unlink would not be present...
a sticky problem - but I hope I have gotten you started...
From: Fabián Eduardo Barco [mailto:febarco at colredes.com]
Sent: Thursday, February 07, 2002 4:20 PM
Subject: [Samba] about logs
I have a file server ( redhat 6.1 + samba 2.0.7 ) and windows 9x, 2000
How do I log the delete of my users?
I want to know who removes a file o a directory in my file server.
I try debug level = 3 in smb.conf but I think it isn't too clear.
is there another way to do it?
To unsubscribe from this list go to the following URL and read the
More information about the samba