[Samba] full_audit syslog logging question

[Andrew Bartlett]

On Mon, 2023-03-13 at 11:30 -0700, Jeremy Allison via samba wrote:
> On Mon, Mar 13, 2023 at 05:51:22PM +0000, Wyll Ingersoll via samba
> wrote:
> > In case anyone is interested, I found the problem.
> > 
> > I was running samba in a container that did not have any syslog
> > service (rsyslogd or syslog-ng) running.  By default, samba syslog
> > only sends messages to the system's syslog socket and there was
> > nothing listening on it so the messages just got dropped.  I put
> > rsyslogd in the container and configured it to listen on the syslog
> > socket and am now able to forward the logs as desired.
> > 
> > Feature request:  add a syslog logging option in the [global]
> > config section that would allow a syslog destination address:port
> > option to send logs elsewhere without requiring a local syslog
> > daemon to do it.
> > 
> > thanks!
> 
> Thanks very much for following up with the answer, that's
> going to be very useful for others running Samba in a
> container.

I don't think we are likely to add a syslog client to Samba (able to
forward to another server) to replace the call to syslog(), but we certainly could accept a patch to the docs to mention this limitiation regarding containers, suggesting either running rsyslog (not how containers are normally done) or bind the socket to another container that does run that (more typical, I'm told). 

Andrew Bartlett


-- 
Andrew Bartlett (he/him)       https://samba.org/~abartlet/
Samba Team Member (since 2001) https://samba.org
Samba Team Lead, Catalyst IT   https://catalyst.net.nz/services/samba

Samba Development and Support, Catalyst.Net Limited

Catalyst.Net Ltd - a Catalyst IT group company - Expert Open Source
Solutions