[Samba] vfs_full_audit and facility 'auth'...

[Rowland Penny]

On Tue, 8 May 2018 17:01:38 +0200
Marco Gaiarin via samba <samba at lists.samba.org> wrote:

> 
> I've tried to setup VFS full audit facility in some share, like:
> 
> 	vfs objects = [...] full_audit
>         full_audit:prefix = %S|%d|%I|%M|%u
>         full_audit:success = mkdir rmdir read pread write pwrite
> rename unlink full_audit:failure = none 
>         full_audit:facility = auth
>         full_audit:priority = info
> 
> but samba refuse 'full_audit:facility = auth' as a good option:
> 
> 	[2018/05/08 16:32:50.564456,
> 0] ../source3/param/loadparm.c:1179(lp_enum) lp_enum(auth,enum):
> value is not in enum_list!
> 
> Why?! Only local* are acceptable?
> 

From 'man vfs_full_audit'

       full_audit:facility = FACILITY
           Log messages to the named syslog(3) facility.

See 'man syslog' for the 'facilities' you can use.

Rowland