[Samba] Samba Audit Logout/logoff

Andrew Bartlett abartlet at samba.org
Mon Feb 11 20:19:08 UTC 2019

On Mon, 2019-02-11 at 18:03 -0200, Carlos via samba wrote:
> Hi!
> I am working with Applaince Sophos XG, i am used API(DesenvovingĀ  in 
> test) with audit log samba to information IP and user in log in DC, but 
> i need information about logout, is possible obtein in Samba Audit ?
> S.O.: Ubuntu 18.04
> Samba: 4.9.4
> Copilated version

Thanks for your interest.  Sadly logout information isn't reliably
communicated to the DC.  Some folk use modules like the vfs_full_audit
and ensure a share is held open against a server, but the DC protocols
themselves (which is what is hooked into the JSON audit stuff) only see
logon traffic.

But you are surely not the first one to have needed this, so I'm hoping
other folks here have some tricks that may assist. 


Andrew Bartlett

Andrew Bartlett
Authentication Developer, Samba Team         https://samba.org
Samba Development and Support, Catalyst IT   

More information about the samba mailing list