[Samba] HEX-value in log during audit

Christof Schmitt cs at samba.org
Tue Apr 5 17:08:54 UTC 2022


On Tue, Apr 05, 2022 at 04:39:20PM +0200, Stefan Kania via samba wrote:
> Hi to all,
> 
> short question:
> If I activate auditing in smb.conf like this:
> --------
>     full_audit:failure = none
>     full_audit:success = renameat create_file write
>     full_audit:prefix = IP=%I|USER=%u|MACHINE=%m|VOLUME=%S
>     full_audit:facility = local5
>     full_audit:priority = NOTICE
> --------
> I see
> 
> .....VOLUME=xxx|create_file|ok|0x100081|file|open|/xxx
> 
> -------
> What is the meaning of the HEX value "0x100081"

That is the "desired access" from the create request. In this case, the
client is asking to open the file with READ_DATA and READ_ATTRIBUTES
(and SYNCHRONIZE which is basically ignored).

Christof



More information about the samba mailing list