[Samba] VFS audit

[Ryan Taylor]

When I use 'vfs objects = audit' then I get nice messages in the syslog like:

Feb  1 17:17:57 tethys smbd_audit[19432]: opendir Workspace
Feb  1 17:17:58 tethys smbd_audit[19432]: open Workspace/test.txt (fd 27)
Feb  1 17:18:00 tethys smbd_audit[19432]: close fd 27
Feb  1 17:17:58 tethys smbd_audit[19432]: open Workspace/test.txt (fd
27) for writing
Feb  1 17:17:58 tethys smbd_audit[19432]: opendir Workspace
Feb  1 17:17:58 tethys smbd_audit[19432]: open Workspace/test.txt (fd 28)
Feb  1 17:17:58 tethys smbd_audit[19432]: close fd 28
Feb  1 17:17:58 tethys smbd_audit[19432]: close fd 27
Feb  1 17:18:02 tethys smbd_audit[19432]: disconnected

#########################################
But with 'audit' it only outputs to the syslog;
If I use 'extd_audit' then it outputs to both syslog and the logfile I
specified ( %U.%m.log )
However not the same... like:
[2006/02/01 17:12:46, 1] modules/vfs_extd_audit.c:audit_opendir(164)
  vfs_extd_audit: opendir Workspace
[2006/02/01 17:16:05, 10] modules/vfs_extd_audit.c:init_module(362)
  vfs_extd_audit: Debug class number of 'extd_audit': 18
[2006/02/01 17:16:07, 10] modules/vfs_extd_audit.c:audit_connect(135)
  Connected to service proj as user mance
[2006/02/01 17:16:07, 10] modules/vfs_extd_audit.c:audit_disconnect(145)
  Disconnected from VFS module extd_audit
[2006/02/01 17:16:07, 10] modules/vfs_extd_audit.c:audit_connect(135)
  Connected to service proj as user mance
[2006/02/01 17:16:05, 10] modules/vfs_extd_audit.c:audit_disconnect(145)
  Disconnected from VFS module extd_audit
######################################################

Not only is it harder to parse but it doesn't show
open/close/edit/etc.. of files and seems completely different than
'audit'.

I am just wondering if there is a way to get 'audit' results into the
logfile other than syslog.

Thank you for any advise and please let me know if I can include any
more examples or information!



On 2/1/06, Jeremy Allison <jra at samba.org> wrote:
> On Wed, Feb 01, 2006 at 03:45:50PM -0500, Ryan Taylor wrote:
> > I would like to turn on auditing for a particular share and have all
> > auditing go to the username.machinename.log files.  If I turn on audit
> > then no matter which way I configure it, it either goes to just syslog,
> > or both.  My goal is to just log to the samba files and take the wieght
> > off of syslog.  I have searched and searched but can't find but a
> > solution that works.  Any help would be greatly
> > appreciated.
> >
> > I have it set now as:
> > ...
> > log level = 0 vfs:2
> > syslog = 0
> > ...
>
> What vfs audit module are you using ? As far as I know the
> all go to syslog.
>
> Jeremy.
>


--
Ryan Taylor
Micro Consultants
770-789-2072
rtaylor82 at gmail.com
"If I had to live my life again, I'd make the same mistakes, only
sooner."  Tallulah Bankhead