Hi! I am working with Applaince Sophos XG, i am used API(Desenvoving in test) with audit log samba to information IP and user in log in DC, but i need information about logout, is possible obtein in Samba Audit ? S.O.: Ubuntu 18.04 Samba: 4.9.4 Copilated version Thanks Regards;
On Mon, 2019-02-11 at 18:03 -0200, Carlos via samba wrote:> Hi! > I am working with Applaince Sophos XG, i am used API(Desenvoving in > test) with audit log samba to information IP and user in log in DC, but > i need information about logout, is possible obtein in Samba Audit ? > > S.O.: Ubuntu 18.04 > Samba: 4.9.4 > Copilated versionThanks for your interest. Sadly logout information isn't reliably communicated to the DC. Some folk use modules like the vfs_full_audit and ensure a share is held open against a server, but the DC protocols themselves (which is what is hooked into the JSON audit stuff) only see logon traffic. But you are surely not the first one to have needed this, so I'm hoping other folks here have some tricks that may assist. Sorry! Andrew Bartlett -- Andrew Bartlett https://samba.org/~abartlet/ Authentication Developer, Samba Team https://samba.org Samba Development and Support, Catalyst IT https://catalyst.net.nz/services/samba
Hi! Thanks for answer Andrew. Regards; On 11/02/2019 18:19, Andrew Bartlett wrote:> On Mon, 2019-02-11 at 18:03 -0200, Carlos via samba wrote: >> Hi! >> I am working with Applaince Sophos XG, i am used API(Desenvoving in >> test) with audit log samba to information IP and user in log in DC, but >> i need information about logout, is possible obtein in Samba Audit ? >> >> S.O.: Ubuntu 18.04 >> Samba: 4.9.4 >> Copilated version > Thanks for your interest. Sadly logout information isn't reliably > communicated to the DC. Some folk use modules like the vfs_full_audit > and ensure a share is held open against a server, but the DC protocols > themselves (which is what is hooked into the JSON audit stuff) only see > logon traffic. > > But you are surely not the first one to have needed this, so I'm hoping > other folks here have some tricks that may assist. > > Sorry! > > Andrew Bartlett >