[Samba] loging user actions

[Chuck Kollars]

> from time to time some of our users delete files. But none of them do
> confess that they have deleted the file. I want to find at the samba 
> logs which user has deleted the file. I´m using the audit-vfs module 
> but there are only messages about opening and closing of files. Can 
> anybody give me a hint for using samba logs to find the users I´m
> searching for?

This is not a direct answer to your question, but rather a suggestion of a different strategy that might resolve your underlying problem:

At a combined middle/high school we implemented vfs-recycle, so our deleted files aren't "really" deleted but rather are moved to a network trash can (which we then regularly trim with 'find' really removing files that haven't been touched in a week). Our requests related to deleted files (why?, please access your backup, etc.) went to ZERO. Our students (who are notoriously impulsive and forgetful) don't ever ask us where a file went any more. 

We found the vfs-recycle strategy works incredibly well for us. We have a second backup mechanism also, but in the last couple of years it's never ever been used nor even investigated. As far as our user students are concerned, the vfs-recycle by itself takes care of all their problems. 
 
-Chuck Kollars