[Samba] Samba Audit Logout/logoff

[Andrew Bartlett]

On Mon, 2019-02-11 at 18:03 -0200, Carlos via samba wrote:
> Hi!
> I am working with Applaince Sophos XG, i am used API(Desenvoving  in 
> test) with audit log samba to information IP and user in log in DC, but 
> i need information about logout, is possible obtein in Samba Audit ?
> 
> S.O.: Ubuntu 18.04
> Samba: 4.9.4
> Copilated version

Thanks for your interest.  Sadly logout information isn't reliably
communicated to the DC.  Some folk use modules like the vfs_full_audit
and ensure a share is held open against a server, but the DC protocols
themselves (which is what is hooked into the JSON audit stuff) only see
logon traffic.

But you are surely not the first one to have needed this, so I'm hoping
other folks here have some tricks that may assist. 

Sorry!

Andrew Bartlett

-- 
Andrew Bartlett
https://samba.org/~abartlet/
Authentication Developer, Samba Team         https://samba.org
Samba Development and Support, Catalyst IT   
https://catalyst.net.nz/services/samba