[Samba] Re: Audit

[rruegner]

Hi Marco,
as a work around you can use the recycle module,
so whatever they delete you will have it
Regards

Marco De Vitis schrieb:

> Il 20/09/2004, alle ore 15:55, rruegner ha scritto:
> 
> 
>>hi, i have something like this in the logs
>>[2004/04/22 08:35:55, 2] smbd/open.c:open_file(240)
>>   tanrit opened file tanrit/Vorlagen/winword2.doc read=Yes write=No 
>>(numopen=5)
>>  so its user time file what else do you miss?
> 
> 
> Some actions are not logged.
> My need came when an empty directory appeared from nowhere in the root of
> a samba share. My boss asked me to check what happened, but I could find
> no trace at all of the dir creation.
> 
> Indeed, I just tried with Samba 3.0.7, log level = 2 and extd_audit
> active: from a Win2000 client I created and then deleted a directory
> inside a share, and nothing about this was logged.
> 
> So it seems also audit modules are useless to me. :-/
> 
> Maybe more actions would be logged if using log level = 3, but this also
> creates loads of uninteresting (to me) log lines.
> 
> The man page for smb.conf says that "This parameter has been extended
> since the 2.2.x series, now it allow to specify the debug level for
> multiple debug classes", but how can I know which debug classes are
> available to use, and how log level values affect them regarding logged
> operations?
> 
> 
>>i tried to set
>>/var/log/samba/%U.%m.log
>>to have user at machine log but this fails, i guess of massive logging 
> 
> 
> That's strange, I have almost the same setting and it works fine:
> log file = /var/log/samba/%m.%U.log
>