[Samba] User authentication log

Aaron E. ssureshot at gmail.com
Thu Nov 10 08:25:05 MST 2011

We've changed the password for the administrator account, once it was 
changed a few minutes later the administrator account locked out, 
Something is set to log in as admin on our network whether it be a share 
set up with those credentials,, not sure at this point..

I'm having trouble finding any logs of failed login attempts, and would 
like some help on getting the proper logging or pointers on what to grep 
for from the logs, or anything that will point me in the right direction 
to find the nodes in questions? I have an openldap backend..

Right now for logging I have

    #log file = /var/log/samba/%m.%U.log
    log file = /var/log/samba/%m.log
    log level = 5

    vfs objects = full_audit
    full_audit:prefix = %u|%I|%m|%S
    full_audit:success = connect mkdir rename rmdir 
#full_audit:success = all
    full_audit:failure = none
    full_audit:facility = LOCAL7
    full_audit:priority = alert

Thank you Very much,

More information about the samba mailing list