[Samba] HEX-value in log during audit
Christof Schmitt
cs at samba.org
Tue Apr 5 17:08:54 UTC 2022
On Tue, Apr 05, 2022 at 04:39:20PM +0200, Stefan Kania via samba wrote:
> Hi to all,
>
> short question:
> If I activate auditing in smb.conf like this:
> --------
> full_audit:failure = none
> full_audit:success = renameat create_file write
> full_audit:prefix = IP=%I|USER=%u|MACHINE=%m|VOLUME=%S
> full_audit:facility = local5
> full_audit:priority = NOTICE
> --------
> I see
>
> .....VOLUME=xxx|create_file|ok|0x100081|file|open|/xxx
>
> -------
> What is the meaning of the HEX value "0x100081"
That is the "desired access" from the create request. In this case, the
client is asking to open the file with READ_DATA and READ_ATTRIBUTES
(and SYNCHRONIZE which is basically ignored).
Christof
More information about the samba
mailing list