[Samba] opendir messages with log level = 1 and extd_audit
Ralf Gross
Ralf-Lists at ralfgross.de
Fri Feb 9 13:48:55 GMT 2007
Hi,
I'm using samba 3.0.23d on Debian Etch and wat to use the extd_audit vfs
module.
In the global section of my smb.conf I use:
log level = 1 vfs:0
And in the share section:
vfs objects = extd_audit
With log lovel 0 for the vfs module I expected to see messages about
deleted/unlinked files and directories + mkdir commands. In fact I get opendir
messages too. This is filling up the logfile rather quickly.
[2007/02/09 13:32:48, 1] modules/vfs_extd_audit.c:audit_opendir(164)
vfs_extd_audit: opendir tmp
[2007/02/09 13:32:48, 1] modules/vfs_extd_audit.c:audit_opendir(164)
vfs_extd_audit: opendir ./
>From http://us4.samba.org/samba/docs/man/Samba-HOWTO-Collection/VFS.html:
###
* extd_audit
This module is identical with the audit module above except that it sends audit
logs to both syslog as well as the smbd log files. The log level for this
module is set in the smb.conf file.
Valid settings and the information that will be recorded are shown in the next table.
Table 23.1. Extended Auditing Log Information
Log Level Log Details - File and Directory Operations
0 Make Directory, Remove Directory, Unlink
1 Open Directory, Rename File, Change Permissions/ACLs
2 Open & Close File
10 Maximum Debug Level
###
Is it the expected behaviour that extd_audit logs the opendir commands? I found
a bug report about this with the comment that "the ext_audit module works as
designed".
https://bugzilla.samba.org/show_bug.cgi?id=1950
I'm now plying around with the full_audit option, but it seems to be poorly
documented.
Ralf
More information about the samba
mailing list