samba - Nov 2021 - auth_audit on samba 4.15

Hi. 

I'm running a samba DC 4.14.10. I've configured logging so that 


    * Important messages about the service go to the Journal (level 1) 
    * auth_audit logs in /var/log/samba/auth.log at level 3 
    * auth_json_audit in /var/log/samba/json/auth.log at level 4 

This is done with 

logging = systemd at 1 file 
log level = auth_audit:3@/var/log/samba/auth.log
auth_json_audit:4@/var/log/samba/json/auth.log

After upgrading to samba 4.15.2, there's no authentication message sent
anymore in those log files. Only authorization ones (if level >= 4).
I checked the manual, but found no change regarding that. 

Is that expected ? Should I change anything in my conf to get authentication
logged again, or is this a bug ?

Regards, 
Daniel 

-- 
Daniel Berteaud

On Fri, 2021-11-26 at 18:24 +0100, Daniel Berteaud via samba
wrote:
> This is done with 
> 
> logging = systemd at 1 file 
> log level = auth_audit:3@/var/log/samba/auth.log
auth_json_audit:4@/var/log/samba/json/auth.log
> 
> After upgrading to samba 4.15.2, there's no authentication message sent
anymore in those log files. Only authorization ones (if level >= 4).
> I checked the manual, but found no change regarding that. 
> 
> Is that expected ? Should I change anything in my conf to get
authentication logged again, or is this a bug ?
Sounds like a bug.  The emission of audit logs is not tested (was too
hard), only the code right up to where they are printed, so a
regression certainly is possible.

Do you have the time to try a 'git bisect' to find out where this went
wrong?

Do the bisect between the tags samba-4.14.0rc1 and samba-4.15.2

And yes, please file a bug, I've sent you an invite to our bugzilla.

Andrew Bartlett


-- 
Andrew Bartlett (he/him)        https://samba.org/~abartlet/
Samba Team Member (since 2001)  https://samba.org
Samba Developer, Catalyst IT    https://catalyst.net.nz/services/samba