[Samba] Security event log in samba 4.4.5 domain controller

[Andrew Bartlett]

On Wed, 2016-09-14 at 11:38 +0200, Trenta sis via samba wrote:
> Hi,
> 
> 
> I have samba 4.4.5 configured as AD wortking correctly, now I need to
> configure Mcafee Logon Collector to receive security event about user
> login, this application requires to read security event log about
> domain
> controller
> I have tried to connecto to doamin controller form windows server
> with
> connect as and view event log but any event viewer is showed...
> 
> I have tried to configure https://wiki.samba.org/index.php/Event_Logg
> ing
> 
> smb.conf
> 
>  eventlog list = Application System Security SyslogLinux
> 
> but we don't see any event log related to pdc, how can I do this?

Sadly Samba does not support auditing of logon events via the event log
at the moment. 

Indeed, auditing as a whole topic is sadly not well implemented, it is
hard even to get enough of the right info from our log files.  (Level 2
logs give you most of what you want, but it is poorly structured). 

Sorry,

Andrew Bartlett

-- 
Andrew Bartlett                       http://samba.org/~abartlet/
Authentication Developer, Samba Team  http://samba.org
Samba Developer, Catalyst IT          http://catalyst.net.nz/services/samba