[Samba] Samba VFS issue
Volker.Lendecke at SerNet.DE
Sun May 14 09:37:21 GMT 2006
On Sun, May 14, 2006 at 02:40:15PM +0530, Honey Bajaj wrote:
> I can customize Sa-Samba module to log only the details about user/system
> from where the files are getting deleted or moved, where as full-audit
> module is pretty bulky and it logs lots of things and on the first instance
> it didn't give the output as it is given by Sa-samba. My requirement is I
> only want to log details to syslog when any file/folder is deleted or
> unlink. Please advise
Further down find the comment on top of vfs_full_audit.c.
So you would use
vfs objects = full_audit
full_audit:prefix = %u|%I
full_audit:success = unlink
full_audit:failure = unlink
Hope that helps,
* This module implements parseable logging for all Samba
* VFS operations.
* You use it as follows:
* path = /tmp
* vfs objects = full_audit
* full_audit:prefix = %u|%I
* full_audit:success = open opendir
* full_audit:failure = all
* vfs op can be "all" which means log all operations.
* vfs op can be "none" which means no logging.
* This leads to syslog entries of the form:
* smbd_audit: nobody|192.168.234.1|opendir|ok|.
* smbd_audit: nobody|192.168.234.1|open|fail (File not found)|r|x.txt
* where "nobody" is the connected username and
* "192.168.234.1" is the
* client's IP address.
* prefix: A macro expansion template prepended to the
* syslog entry.
* success: A list of VFS operations for which a successful
* completion should
* be logged. Defaults to no logging at all. The special
* operation "all" logs
* - you guessed it - everything.
* failure: A list of VFS operations for which failure to
* complete should be
* logged. Defaults to logging everything.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Size: 189 bytes
Desc: not available
Url : http://lists.samba.org/archive/samba/attachments/20060514/d35dfb99/attachment.bin
More information about the samba