[Samba] How should audit logging work?

Nick Howitt nick at howitts.co.uk
Tue Oct 12 10:21:52 UTC 2021



On 12/10/2021 10:55, Rowland Penny via samba wrote:
> 
> By no means can you describe a PDC as a simple file server :-D
> 
Sorry. ClearOS terminology :S
>>
>>
>> [test]
>>           vfs objects = full_audit:audit
> 
> Try it like this:
> 
>             vfs objects = full_audit audit

Hmm. That logs a single line:
Oct 12 11:06:50 microserver smbd_audit[18821]: connect to service test 
by user test1

It I do the edits I described I get a lot more when opening, creating 
and deleting files:

Oct 12 11:17:48 microserver smbd_audit: test1|stat|fail (No such file or 
directory)|/var/flexshare/shares/test/subdolder/New folder
Oct 12 11:17:48 microserver smbd_audit: test1|stat|fail (No such file or 
directory)|/var/flexshare/shares/test/subdolder/New folder
Oct 12 11:17:48 microserver smbd_audit: test1|opendir|ok|.
Oct 12 11:17:48 microserver smbd_audit: test1|realpath|fail (No such 
file or directory)|subdolder/New folder
Oct 12 11:17:48 microserver smbd_audit: test1|create_file|fail (No such 
file or 
directory)|0x100080|file|open|/var/flexshare/shares/test/subdolder/New 
folder
Oct 12 11:17:48 microserver smbd_audit: 
test1|open|ok|r|/var/flexshare/shares/test/subdolder
Oct 12 11:17:48 microserver smbd_audit: 
test1|open|ok|r|/var/flexshare/shares/test/subdolder
Oct 12 11:17:48 microserver smbd_audit: test1|readdir_attr|fail 
(Operation not supported)|/var/flexshare/shares/test/subdolder/.
Oct 12 11:17:48 microserver smbd_audit: test1|getxattr|fail (No data 
available)|subdolder/..|user.DOSATTRIB
Oct 12 11:17:48 microserver smbd_audit: test1|get_dos_attributes|fail 
(No data available)|/var/flexshare/shares/test/subdolder/..
Oct 12 11:17:48 microserver smbd_audit: test1|readdir_attr|fail (No data 
available)|/var/flexshare/shares/test/subdolder/..
Oct 12 11:17:48 microserver smbd_audit: test1|readdir_attr|fail 
(Operation not supported)|/var/flexshare/shares/test/subdolder/990
Oct 12 11:17:48 microserver smbd_audit: test1|readdir_attr|fail 
(Operation not supported)|/var/flexshare/shares/test/subdolder/njh
Oct 12 11:17:48 microserver smbd_audit: test1|readdir_attr|fail 
(Operation not supported)|/var/flexshare/shares/test/subdolder/clearos.reg
Oct 12 11:17:48 microserver smbd_audit: 
test1|open|ok|r|/var/flexshare/shares/test/subdolder
Oct 12 11:17:48 microserver smbd_audit: 
test1|open|ok|r|/var/flexshare/shares/test/subdolder
Oct 12 11:17:48 microserver smbd_audit: test1|readdir_attr|fail 
(Operation not supported)|/var/flexshare/shares/test/subdolder/.
Oct 12 11:17:48 microserver smbd_audit: test1|getxattr|fail (No data 
available)|subdolder/..|user.DOSATTRIB
Oct 12 11:17:48 microserver smbd_audit: test1|get_dos_attributes|fail 
(No data available)|/var/flexshare/shares/test/subdolder/..
Oct 12 11:17:48 microserver smbd_audit: test1|readdir_attr|fail (No data 
available)|/var/flexshare/shares/test/subdolder/..
Oct 12 11:17:48 microserver smbd_audit: test1|readdir_attr|fail 
(Operation not supported)|/var/flexshare/shares/test/subdolder/990
Oct 12 11:17:48 microserver smbd_audit: test1|readdir_attr|fail 
(Operation not supported)|/var/flexshare/shares/test/subdolder/njh
Oct 12 11:17:48 microserver smbd_audit: test1|readdir_attr|fail 
(Operation not supported)|/var/flexshare/shares/test/subdolder/clearos.reg
Oct 12 11:17:48 microserver smbd_audit: 
test1|open|ok|r|/var/flexshare/shares/test/subdolder
Oct 12 11:17:48 microserver smbd_audit: 
test1|open|ok|r|/var/flexshare/shares/test/subdolder
Oct 12 11:17:48 microserver smbd_audit: test1|readdir_attr|fail 
(Operation not supported)|/var/flexshare/shares/test/subdolder/.
Oct 12 11:17:48 microserver smbd_audit: test1|getxattr|fail (No data 
available)|subdolder/..|user.DOSATTRIB
Oct 12 11:17:48 microserver smbd_audit: test1|get_dos_attributes|fail 
(No data available)|/var/flexshare/shares/test/subdolder/..
Oct 12 11:17:48 microserver smbd_audit: test1|readdir_attr|fail (No data 
available)|/var/flexshare/shares/test/subdolder/..
Oct 12 11:17:48 microserver smbd_audit: test1|readdir_attr|fail 
(Operation not supported)|/var/flexshare/shares/test/subdolder/990
Oct 12 11:17:48 microserver smbd_audit: test1|readdir_attr|fail 
(Operation not supported)|/var/flexshare/shares/test/subdolder/njh
Oct 12 11:17:48 microserver smbd_audit: test1|readdir_attr|fail 
(Operation not supported)|/var/flexshare/shares/test/subdolder/clearos.reg
Oct 12 11:17:48 microserver smbd_audit: 
test1|open|ok|r|/var/flexshare/shares/test
Oct 12 11:17:48 microserver smbd_audit: test1|getxattr|fail (No data 
available)|.|user.DOSATTRIB
Oct 12 11:17:48 microserver smbd_audit: test1|get_dos_attributes|fail 
(No data available)|/var/flexshare/shares/test
Oct 12 11:17:48 microserver smbd_audit: test1|readdir_attr|fail (No data 
available)|/var/flexshare/shares/test
Oct 12 11:17:48 microserver smbd_audit: test1|getxattr|fail (No data 
available)|..|user.DOSATTRIB
Oct 12 11:17:48 microserver smbd_audit: test1|get_dos_attributes|fail 
(No data available)|/var/flexshare/shares/test/..
Oct 12 11:17:48 microserver smbd_audit: test1|readdir_attr|fail (No data 
available)|/var/flexshare/shares/test/..
Oct 12 11:17:48 microserver smbd_audit: test1|getxattr|fail (No data 
available)|990|user.DOSATTRIB
Oct 12 11:17:48 microserver smbd_audit: test1|get_dos_attributes|fail 
(No data available)|/var/flexshare/shares/test/990
Oct 12 11:17:48 microserver smbd_audit: test1|readdir_attr|fail (No data 
available)|/var/flexshare/shares/test/990
Oct 12 11:17:48 microserver smbd_audit: test1|getxattr|fail (No data 
available)|logon.cmd|user.DOSATTRIB
Oct 12 11:17:48 microserver smbd_audit: test1|get_dos_attributes|fail 
(No data available)|/var/flexshare/shares/test/logon.cmd
Oct 12 11:17:48 microserver smbd_audit: test1|readdir_attr|fail (No data 
available)|/var/flexshare/shares/test/logon.cmd
Oct 12 11:17:48 microserver smbd_audit: test1|getxattr|fail (No data 
available)|.trash|user.DOSATTRIB
Oct 12 11:17:48 microserver smbd_audit: test1|get_dos_attributes|fail 
(No data available)|/var/flexshare/shares/test/.trash
Oct 12 11:17:48 microserver smbd_audit: test1|readdir_attr|fail (No data 
available)|/var/flexshare/shares/test/.trash
Oct 12 11:17:48 microserver smbd_audit: test1|readdir_attr|fail 
(Operation not supported)|/var/flexshare/shares/test/subdolder
Oct 12 11:17:48 microserver smbd_audit: test1|readdir_attr|fail 
(Operation not supported)|/var/flexshare/shares/test/21

Nick



More information about the samba mailing list