[Samba] Samba VFS issue

[Volker Lendecke]

On Sun, May 14, 2006 at 02:40:15PM +0530, Honey Bajaj wrote:
> I can customize Sa-Samba module to log only the details about user/system
> from where the files are getting  deleted or moved, where as full-audit
> module is pretty bulky and it logs lots of things and on the first instance
> it didn't give the output as it is given by Sa-samba. My requirement is I
> only want to log details to syslog when any file/folder is deleted or
> unlink. Please advise

Further down find the comment on top of vfs_full_audit.c.

So you would use

vfs objects = full_audit
full_audit:prefix = %u|%I
full_audit:success = unlink
full_audit:failure = unlink

Hope that helps,

Volker

/*
 * This module implements parseable logging for all Samba
 * VFS operations.
 *
 * You use it as follows:
 *
 * [tmp]
 * path = /tmp
 * vfs objects = full_audit
 * full_audit:prefix = %u|%I
 * full_audit:success = open opendir
 * full_audit:failure = all
 *
 * vfs op can be "all" which means log all operations.
 * vfs op can be "none" which means no logging.
 *
 * This leads to syslog entries of the form:
 * smbd_audit: nobody|192.168.234.1|opendir|ok|.
 * smbd_audit: nobody|192.168.234.1|open|fail (File not found)|r|x.txt
 *
 * where "nobody" is the connected username and
 * "192.168.234.1" is the
 * client's IP address.
 *
 * Options:
 *
 * prefix: A macro expansion template prepended to the
 * syslog entry.
 *
 * success: A list of VFS operations for which a successful
 * completion should
 * be logged. Defaults to no logging at all. The special
 * operation "all" logs
 * - you guessed it - everything.
 *
 * failure: A list of VFS operations for which failure to
 * complete should be
 * logged. Defaults to logging everything.
 */
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: not available
Url : http://lists.samba.org/archive/samba/attachments/20060514/d35dfb99/attachment.bin