[Samba] I need to log user logon and logoff

[Joe Zacky]

On 3/21/2017 5:44 PM, Andrew Bartlett via samba wrote:
> On Tue, 2017-03-21 at 10:05 -0500, Denis Morejon via samba wrote:
>> I need to log to a separated file just user/computer logon and
>> logoff.
>>
>> I would like not to use log level > 2 to do this.
>>
>> I have tried using vfs_full_audit but it works well into shares
>> definitions.
>>
>> I don't care if the user access a shared directory, I just need to
>> record user login and logoff.
> This will be much easier once the auth logging patch, which I'm working
> on right now with Gary Lockyer lands.
>
> It will be in Samba 4.7.
>
> User log-off is harder to log, but user logon will be well tracked.
>
> Thanks,
>
> Andrew Bartlett

If you're referring to logging on to a samba share, you can use the 
preexec configuration parameter in smb.conf with a custom script to do 
the actuall logging.  It only logs the logon, not the logoff. This is 
what I have in my smb.conf.

    preexec = /usr/local/bin/loguser.sh "%I,%m,%U,%T,%M,%a,%D,%h,%S"


And this is the script that does the logging, loguser.sh:

    #!/bin/sh

    # This script is run from the preeexec option in smb.conf

    /bin/echo -E "$@" >> /var/tmp/login.log

    # END

Joe Zacky