[Samba] File deletion auditing

[Dante Colo]

Hi David . 


I'm sorry, i deleted the word "full_audit" accidentally before copy and paste in the email here , i can audit directory deletion, file write, file rename but not file deletion. 



[share1] 
vfs objects = aio_pthread,zfsacl,full_audit 
aio read size = 32768 
aio write size = 32768 
full_audit:success = write mkdir rmdir pwrite rename 
full_audit:failure = write mkdir rmdir pwrite rename 
full_audit:facility = LOCAL0 
full_audit:priority = NOTICE 
path=/samba-rb/test_share 
writable = yes 
browsable = yes 
inherit owner = yes 

----- Original Message -----

From: "David Disseldorp" <ddiss at suse.de> 
To: "Dante Colo" <dante.colo at stwbrasil.com> 
Cc: "samba" <samba at lists.samba.org> 
Sent: Wednesday, May 28, 2014 9:40:03 AM 
Subject: Re: [Samba] File deletion auditing 

Hi Dante, 

On Wed, 28 May 2014 09:30:48 -0300 (BRT), Dante Colo wrote: 

> I'm testing the module vfs_full_audit on samba 4.0.17 under FreeBSD 10, i couldn't figure out how to audit file deletions only directories, is this possible ? This is my share setup. 
> 
> 
> [share1] 
> vfs objects = aio_pthread,zfsacl 

The full audit VFS module needs to be enabled for the share, e.g. 
vfs objects = full_audit aio_pthread zfsacl 

Cheers, David