[Samba] VFS audit

[Deryck Hodge]

On 2/7/06, Ryan Taylor <rtaylor82 at gmail.com> wrote:
> That is great! And only leaves one problem:  The only way we know
> easily who did what and where is by putting the logs in a log file
> like "%U.%m.log" .  Is there yet another way to accomplish this
> because syslog doesn't have those variables?  The ultimate goal is to
> parse and put in a database for statistics and finding out who messed
> up.
>
> Biggest question yet: Is there somewhere I could have read to find the
> solution you suggested above with the facilities/priority etc.. I hate
> to ask questions like this if there is somewhere I can read and learn
> from myself.  I have searched the Internet tirelessly and have not run
> across the solution you suggested.  How can I find such solutions...?!
>
> Thank you for your time and help!,
>

See John's post at the top of this thread (from this list via Google groups):
http://groups.google.com/group/linux.samba/browse_thread/thread/473b9e9f57235416/ba89a22fc1e25a95?lnk=st&q=group%3A*samba*+vfs+log+author%3Aterpstra&rnum=1#ba89a22fc1e25a95

The facility and priority parameters are new for the audit modules and
are not documented yet.  Prior to those smb.conf parameters (and as
the default setting now) audit modules log to user.notice.

Cheers,
deryck

--
Deryck Hodge
http://www.devurandom.org/
http://www.samba.org/

"Aimless days, uncool ways of decathecting" --Mike Doughty (2005)