[Samba] unable to see event viewer on DC

[Andrew Bartlett]

On Mon, 2016-12-05 at 12:39 +0100, Stefan via samba wrote:
>  
> 
> Hi 
> 
> I am trying to enable auditing and see logs (events) on the DC
> (samba4
> on debian jessie). I am trying to follow/understand
> https://wiki.samba.org/index.php/Event_Logging [1] but with no
> success.
> I have edited smb.conf and restarted samba daemon. When trying to
> connect DC using event viewer on a windows server connected to the
> domain as administrator user, I get error: The procedure number is
> out
> of range(1745). Anyone knows why, or what I can do to solve it? 

Sadly even if the RPC error was resolved, no events are logged.  We
write to log.samba, but the AD DC does not to 'event log'.  We know
this would be desirable, because I've had customers ask me what would
be involved to implement it, as there are GUIs and tools that can parse
those logs, but there are not currently any plans to implement that.  

Thanks,

Andrew Bartlett

-- 
Andrew Bartlett                       http://samba.org/~abartlet/
Authentication Developer, Samba Team  http://samba.org
Samba Developer, Catalyst IT          http://catalyst.net.nz/services/samba