[Samba] How should audit logging work?
Nick Howitt
nick at howitts.co.uk
Tue Oct 12 10:21:52 UTC 2021
On 12/10/2021 10:55, Rowland Penny via samba wrote:
>
> By no means can you describe a PDC as a simple file server :-D
>
Sorry. ClearOS terminology :S
>>
>>
>> [test]
>> vfs objects = full_audit:audit
>
> Try it like this:
>
> vfs objects = full_audit audit
Hmm. That logs a single line:
Oct 12 11:06:50 microserver smbd_audit[18821]: connect to service test
by user test1
It I do the edits I described I get a lot more when opening, creating
and deleting files:
Oct 12 11:17:48 microserver smbd_audit: test1|stat|fail (No such file or
directory)|/var/flexshare/shares/test/subdolder/New folder
Oct 12 11:17:48 microserver smbd_audit: test1|stat|fail (No such file or
directory)|/var/flexshare/shares/test/subdolder/New folder
Oct 12 11:17:48 microserver smbd_audit: test1|opendir|ok|.
Oct 12 11:17:48 microserver smbd_audit: test1|realpath|fail (No such
file or directory)|subdolder/New folder
Oct 12 11:17:48 microserver smbd_audit: test1|create_file|fail (No such
file or
directory)|0x100080|file|open|/var/flexshare/shares/test/subdolder/New
folder
Oct 12 11:17:48 microserver smbd_audit:
test1|open|ok|r|/var/flexshare/shares/test/subdolder
Oct 12 11:17:48 microserver smbd_audit:
test1|open|ok|r|/var/flexshare/shares/test/subdolder
Oct 12 11:17:48 microserver smbd_audit: test1|readdir_attr|fail
(Operation not supported)|/var/flexshare/shares/test/subdolder/.
Oct 12 11:17:48 microserver smbd_audit: test1|getxattr|fail (No data
available)|subdolder/..|user.DOSATTRIB
Oct 12 11:17:48 microserver smbd_audit: test1|get_dos_attributes|fail
(No data available)|/var/flexshare/shares/test/subdolder/..
Oct 12 11:17:48 microserver smbd_audit: test1|readdir_attr|fail (No data
available)|/var/flexshare/shares/test/subdolder/..
Oct 12 11:17:48 microserver smbd_audit: test1|readdir_attr|fail
(Operation not supported)|/var/flexshare/shares/test/subdolder/990
Oct 12 11:17:48 microserver smbd_audit: test1|readdir_attr|fail
(Operation not supported)|/var/flexshare/shares/test/subdolder/njh
Oct 12 11:17:48 microserver smbd_audit: test1|readdir_attr|fail
(Operation not supported)|/var/flexshare/shares/test/subdolder/clearos.reg
Oct 12 11:17:48 microserver smbd_audit:
test1|open|ok|r|/var/flexshare/shares/test/subdolder
Oct 12 11:17:48 microserver smbd_audit:
test1|open|ok|r|/var/flexshare/shares/test/subdolder
Oct 12 11:17:48 microserver smbd_audit: test1|readdir_attr|fail
(Operation not supported)|/var/flexshare/shares/test/subdolder/.
Oct 12 11:17:48 microserver smbd_audit: test1|getxattr|fail (No data
available)|subdolder/..|user.DOSATTRIB
Oct 12 11:17:48 microserver smbd_audit: test1|get_dos_attributes|fail
(No data available)|/var/flexshare/shares/test/subdolder/..
Oct 12 11:17:48 microserver smbd_audit: test1|readdir_attr|fail (No data
available)|/var/flexshare/shares/test/subdolder/..
Oct 12 11:17:48 microserver smbd_audit: test1|readdir_attr|fail
(Operation not supported)|/var/flexshare/shares/test/subdolder/990
Oct 12 11:17:48 microserver smbd_audit: test1|readdir_attr|fail
(Operation not supported)|/var/flexshare/shares/test/subdolder/njh
Oct 12 11:17:48 microserver smbd_audit: test1|readdir_attr|fail
(Operation not supported)|/var/flexshare/shares/test/subdolder/clearos.reg
Oct 12 11:17:48 microserver smbd_audit:
test1|open|ok|r|/var/flexshare/shares/test/subdolder
Oct 12 11:17:48 microserver smbd_audit:
test1|open|ok|r|/var/flexshare/shares/test/subdolder
Oct 12 11:17:48 microserver smbd_audit: test1|readdir_attr|fail
(Operation not supported)|/var/flexshare/shares/test/subdolder/.
Oct 12 11:17:48 microserver smbd_audit: test1|getxattr|fail (No data
available)|subdolder/..|user.DOSATTRIB
Oct 12 11:17:48 microserver smbd_audit: test1|get_dos_attributes|fail
(No data available)|/var/flexshare/shares/test/subdolder/..
Oct 12 11:17:48 microserver smbd_audit: test1|readdir_attr|fail (No data
available)|/var/flexshare/shares/test/subdolder/..
Oct 12 11:17:48 microserver smbd_audit: test1|readdir_attr|fail
(Operation not supported)|/var/flexshare/shares/test/subdolder/990
Oct 12 11:17:48 microserver smbd_audit: test1|readdir_attr|fail
(Operation not supported)|/var/flexshare/shares/test/subdolder/njh
Oct 12 11:17:48 microserver smbd_audit: test1|readdir_attr|fail
(Operation not supported)|/var/flexshare/shares/test/subdolder/clearos.reg
Oct 12 11:17:48 microserver smbd_audit:
test1|open|ok|r|/var/flexshare/shares/test
Oct 12 11:17:48 microserver smbd_audit: test1|getxattr|fail (No data
available)|.|user.DOSATTRIB
Oct 12 11:17:48 microserver smbd_audit: test1|get_dos_attributes|fail
(No data available)|/var/flexshare/shares/test
Oct 12 11:17:48 microserver smbd_audit: test1|readdir_attr|fail (No data
available)|/var/flexshare/shares/test
Oct 12 11:17:48 microserver smbd_audit: test1|getxattr|fail (No data
available)|..|user.DOSATTRIB
Oct 12 11:17:48 microserver smbd_audit: test1|get_dos_attributes|fail
(No data available)|/var/flexshare/shares/test/..
Oct 12 11:17:48 microserver smbd_audit: test1|readdir_attr|fail (No data
available)|/var/flexshare/shares/test/..
Oct 12 11:17:48 microserver smbd_audit: test1|getxattr|fail (No data
available)|990|user.DOSATTRIB
Oct 12 11:17:48 microserver smbd_audit: test1|get_dos_attributes|fail
(No data available)|/var/flexshare/shares/test/990
Oct 12 11:17:48 microserver smbd_audit: test1|readdir_attr|fail (No data
available)|/var/flexshare/shares/test/990
Oct 12 11:17:48 microserver smbd_audit: test1|getxattr|fail (No data
available)|logon.cmd|user.DOSATTRIB
Oct 12 11:17:48 microserver smbd_audit: test1|get_dos_attributes|fail
(No data available)|/var/flexshare/shares/test/logon.cmd
Oct 12 11:17:48 microserver smbd_audit: test1|readdir_attr|fail (No data
available)|/var/flexshare/shares/test/logon.cmd
Oct 12 11:17:48 microserver smbd_audit: test1|getxattr|fail (No data
available)|.trash|user.DOSATTRIB
Oct 12 11:17:48 microserver smbd_audit: test1|get_dos_attributes|fail
(No data available)|/var/flexshare/shares/test/.trash
Oct 12 11:17:48 microserver smbd_audit: test1|readdir_attr|fail (No data
available)|/var/flexshare/shares/test/.trash
Oct 12 11:17:48 microserver smbd_audit: test1|readdir_attr|fail
(Operation not supported)|/var/flexshare/shares/test/subdolder
Oct 12 11:17:48 microserver smbd_audit: test1|readdir_attr|fail
(Operation not supported)|/var/flexshare/shares/test/21
Nick
More information about the samba
mailing list