[Samba] how to log only opened files via vfs_modules?

Hubert Choma hubert.ch at wp.pl
Tue Mar 18 09:25:57 GMT 2008 

I have share with a lot of scan files with .tif extension.
They are grouped in catalogs by years for example 2006 2007 2008 etc.
I would like to log open files (open scanned files .tif) by users. But 
/var/log/messages shows a lot of useless informations!!.

For example user fujitsu opened only file 11005_07.tif in windows 
explorer.
In /var/log/messages I can't exactly know which file was opened by user. 
Audit lists me all touched files by windows explorer but I must know 
which one was opened.
Its generate me a lot of unnecessary entrys in /var/log/messages.

Other operations on files like remove delete or rename are logged 
correctly.

PLEASE HELP !
See my smb.conf

Mar 18 09:54:00 localhost smbd_audit: 
fujitsu|sm17|10.10.10.160|skany|pread|ok|2007/11005_07.tif
Mar 18 09:54:00 localhost smbd_audit: 
fujitsu|sm17|10.10.10.160|skany|pread|ok|2007/12795_07.tif
Mar 18 09:54:00 localhost smbd_audit: 
fujitsu|sm17|10.10.10.160|skany|pread|ok|2007/12795_07.tif
Mar 18 09:54:00 localhost smbd_audit: 
fujitsu|sm17|10.10.10.160|skany|pread|ok|2007/11005_07.tif
Mar 18 09:54:00 localhost smbd_audit: 
fujitsu|sm17|10.10.10.160|skany|pread|ok|2007/12795_07.tif
Mar 18 09:54:00 localhost smbd_audit: 
fujitsu|sm17|10.10.10.160|skany|pread|ok|2007/11005_07.tif
Mar 18 09:54:00 localhost smbd_audit: 
fujitsu|sm17|10.10.10.160|skany|pread|ok|2007/12793_07.tif
Mar 18 09:54:00 localhost smbd_audit: 
fujitsu|sm17|10.10.10.160|skany|pread|ok|2007/12792_07.tif
Mar 18 09:54:00 localhost smbd_audit: 
fujitsu|sm17|10.10.10.160|skany|pread|ok|2007/11005_07.tif
Mar 18 09:54:00 localhost smbd_audit: 
fujitsu|sm17|10.10.10.160|skany|pread|ok|2007/11005_07.tif
Mar 18 09:54:00 localhost smbd_audit: 
fujitsu|sm17|10.10.10.160|skany|pread|ok|2007/12791_07.tif
Mar 18 09:54:00 localhost smbd_audit: 
fujitsu|sm17|10.10.10.160|skany|pread|ok|2007/11005_07.tif
Mar 18 09:54:00 localhost smbd_audit: 
fujitsu|sm17|10.10.10.160|skany|pread|ok|2007/11005_07.tif
Mar 18 09:54:00 localhost smbd_audit: 
fujitsu|sm17|10.10.10.160|skany|pread|ok|2007/12791_07.tif
Mar 18 09:54:00 localhost smbd_audit: 
fujitsu|sm17|10.10.10.160|skany|pread|ok|2007/12791_07.tif
Mar 18 09:54:00 localhost smbd_audit: 
fujitsu|sm17|10.10.10.160|skany|pread|ok|2007/11005_07.tif
Mar 18 09:54:00 localhost smbd_audit: 
fujitsu|sm17|10.10.10.160|skany|pread|ok|2007/12791_07.tif
Mar 18 09:54:00 localhost smbd_audit: 
fujitsu|sm17|10.10.10.160|skany|pread|ok|2007/12791_07.tif
Mar 18 09:54:00 localhost smbd_audit: 
fujitsu|sm17|10.10.10.160|skany|pread|ok|2007/11005_07.tif
Mar 18 09:54:00 localhost smbd_audit: 
fujitsu|sm17|10.10.10.160|skany|pread|ok|2007/12791_07.tif
Mar 18 09:54:00 localhost smbd_audit: 
fujitsu|sm17|10.10.10.160|skany|pread|ok|2007/11005_07.tif
Mar 18 09:54:00 localhost smbd_audit: 
fujitsu|sm17|10.10.10.160|skany|pread|ok|2007/12791_07.tif
Mar 18 09:54:00 localhost smbd_audit: 
fujitsu|sm17|10.10.10.160|skany|pread|ok|2007/11005_07.tif
Mar 18 09:54:00 localhost smbd_audit: 
fujitsu|sm17|10.10.10.160|skany|pread|ok|2007/11005_07.tif
Mar 18 09:54:00 localhost smbd_audit: 
fujitsu|sm17|10.10.10.160|skany|pread|ok|2007/12791_07.tif
Mar 18 09:54:00 localhost smbd_audit: 
fujitsu|sm17|10.10.10.160|skany|pread|ok|2007/12791_07.tif
Mar 18 09:54:00 localhost smbd_audit: 
fujitsu|sm17|10.10.10.160|skany|pread|ok|2007/11005_07.tif
Mar 18 09:54:00 localhost smbd_audit: 
fujitsu|sm17|10.10.10.160|skany|pread|ok|2007/12791_07.tif
Mar 18 09:54:00 localhost smbd_audit: 
fujitsu|sm17|10.10.10.160|skany|pread|ok|2007/11005_07.tif
Mar 18 09:54:00 localhost smbd_audit: 
fujitsu|sm17|10.10.10.160|skany|pread|ok|2007/12791_07.tif
Mar 18 09:54:00 localhost smbd_audit: 
fujitsu|sm17|10.10.10.160|skany|pread|ok|2007/11005_07.tif
Mar 18 09:54:00 localhost smbd_audit: 
fujitsu|sm17|10.10.10.160|skany|pread|ok|2007/12791_07.tif
Mar 18 09:54:00 localhost smbd_audit: 
fujitsu|sm17|10.10.10.160|skany|pread|ok|2007/11005_07.tif
Mar 18 09:54:00 localhost smbd_audit: 
fujitsu|sm17|10.10.10.160|skany|pread|ok|2007/12790_07.tif
Mar 18 09:54:00 localhost smbd_audit: 
fujitsu|sm17|10.10.10.160|skany|pread|ok|2007/11005_07.tif
Mar 18 09:54:00 localhost smbd_audit: 
fujitsu|sm17|10.10.10.160|skany|pread|ok|2007/12790_07.tif
Mar 18 09:54:00 localhost smbd_audit: 
fujitsu|sm17|10.10.10.160|skany|pread|ok|2007/12790_07.tif


smb.conf

[global]
 log level = 2 vfs:3 auth:2 passdb:3
 log file = /var/log/samba/%U.%m.log
 max log size = 5000

[skany]
        comment = skany
;       browseable = yes
        path = /mnt/skany/skany/
        write list = @skanery
        valid users = @geo, at skanery
        deny hosts = korytarz1, korytarz2
        vfs objects = recycle full_audit
        recycle:repository = .recycle/%U
        recycle:touch = true
        recycle:keeptree = true
        recycle:versions = false
        recycle:exclude = *.TMP
        recycle:directory_mode = 773
        full_audit:success = write pwrite rename unlink rmdir mkdir connect read 
pread
        full_audit:prefix = %u|%m|%I|%S
        full_audit:failure = read write
        force create mode = 0777

----------------------------------------------------
Nie rozliczaj PITu na liczydle! Ściągnij formularz PIT, 
który wypełnisz na komputerze. Wystarczy wpisać niezbędne 
dane a obliczenia wykonają się automatycznie! 
http://klik.wp.pl/?adr=http%3A%2F%2Fpodatki.wp.pl%2Fnarzedzia_formularze_aktywne.html&sid=262

More information about the samba mailing list