Hi,
I'm using full_audit vfs module and I'm seeing a lot of duplicated
messages
in log file. Why does it happens ?
How can I configure de smb.conf not to log duplicated information ?
Duplicated log:
Jan 4 13:27:50 server smbd_audit: [2015/01/04
13:27:50|semirames|samba-admin|192.168.0.3|setores]|pread|ok|Atendimento/James.txt
Jan 4 13:27:50 server smbd_audit: [2015/01/04
13:27:50|semirames|samba-admin|192.168.0.3|setores]|pread|ok|Atendimento/James.txt
Jan 4 13:27:50 server smbd_audit: [2015/01/04
13:27:50|semirames|samba-admin|192.168.0.3|setores]|pread|ok|Atendimento/James.txt
Jan 4 13:27:50 server smbd_audit: [2015/01/04
13:27:50|semirames|samba-admin|192.168.0.3|setores]|pread|ok|Atendimento/James.txt
My smb.conf:
# Global parameters
[global]
workgroup = BASE
realm = BASE.LOCAL
netbios name = SERVER
server role = active directory domain controller
dns forwarder = 192.168.0.3
smb ports = 139
vfs objects = acl_xattr full_audit
full_audit:prefix = [%T|%U|%m|%I|%S]
full_audit:success = connect mkdir rmdir rename unlink fset_nt_acl
fsetxattr pread pwrite
full_audit:failure = none
full_audit:facility = local1
full_audit:priority = debug
[...]
--
Att,
Thol
On 04/01/15 16:30, Thiago Ten?rio wrote:> Hi, > > I'm using full_audit vfs module and I'm seeing a lot of duplicated messages > in log file. Why does it happens ? > How can I configure de smb.conf not to log duplicated information ? > > Duplicated log: > > Jan 4 13:27:50 server smbd_audit: [2015/01/04 > 13:27:50|semirames|samba-admin|192.168.0.3|setores]|pread|ok|Atendimento/James.txt > Jan 4 13:27:50 server smbd_audit: [2015/01/04 > 13:27:50|semirames|samba-admin|192.168.0.3|setores]|pread|ok|Atendimento/James.txt > Jan 4 13:27:50 server smbd_audit: [2015/01/04 > 13:27:50|semirames|samba-admin|192.168.0.3|setores]|pread|ok|Atendimento/James.txt > Jan 4 13:27:50 server smbd_audit: [2015/01/04 > 13:27:50|semirames|samba-admin|192.168.0.3|setores]|pread|ok|Atendimento/James.txt > > My smb.conf: > > # Global parameters > [global] > workgroup = BASE > realm = BASE.LOCAL > netbios name = SERVER > server role = active directory domain controller > dns forwarder = 192.168.0.3 > > smb ports = 139 > > vfs objects = acl_xattr full_audit > full_audit:prefix = [%T|%U|%m|%I|%S] > full_audit:success = connect mkdir rmdir rename unlink fset_nt_acl > fsetxattr pread pwrite > full_audit:failure = none > full_audit:facility = local1 > full_audit:priority = debug > > [...] > >OK, if your realm really does end in .local, this makes you number 4 this week, you should not use .local, see the wiki. also by adding 'vfs objects = acl_xattr full_audit' to smb.conf you have turned off 'dfs_samba4', the correct line should be: ''vfs objects = dfs_samba4, acl_xattr, full_audit' You need to add to the default line or you turn off the defaults. Unfortunately, I do think 'full_audit' works with a samba4 AD DC. Rowland
On Sun, Jan 04, 2015 at 01:30:27PM -0300, Thiago Ten?rio wrote:> Hi, > > I'm using full_audit vfs module and I'm seeing a lot of duplicated messages > in log file. Why does it happens ? > How can I configure de smb.conf not to log duplicated information ? > > Duplicated log: > > Jan 4 13:27:50 server smbd_audit: [2015/01/04 > 13:27:50|semirames|samba-admin|192.168.0.3|setores]|pread|ok|Atendimento/James.txt > Jan 4 13:27:50 server smbd_audit: [2015/01/04 > 13:27:50|semirames|samba-admin|192.168.0.3|setores]|pread|ok|Atendimento/James.txt > Jan 4 13:27:50 server smbd_audit: [2015/01/04 > 13:27:50|semirames|samba-admin|192.168.0.3|setores]|pread|ok|Atendimento/James.txt > Jan 4 13:27:50 server smbd_audit: [2015/01/04 > 13:27:50|semirames|samba-admin|192.168.0.3|setores]|pread|ok|Atendimento/James.txtThat's not duplicates. A client is reading the file piece by piece. Volker -- SerNet GmbH, Bahnhofsallee 1b, 37081 G?ttingen phone: +49-551-370000-0, fax: +49-551-370000-9 AG G?ttingen, HRB 2816, GF: Dr. Johannes Loxen http://www.sernet.de, mailto:kontakt at sernet.de