samba - Feb 2007 - audit module

hey,

i need to know who deleted files on our server so i added the audit module. but
now i cant find any hint in the log file which user deleted the file. it just
shows me "Feb  6 13:54:57 smb.-server smbd_audit[13881]: opendir
.recycle". How can i do that?

another question is: how can i tell samba to keep more versions of the log
files? Now it only keeps a client.log and a client.log.old.

thanks for help and best regards





 
____________________________________________________________________________________
Never Miss an Email
Stay connected with Yahoo! Mail on your mobile.  Get started!
http://mobile.yahoo.com/services?promote=mail

Sascha wrote:

{munch}
> another question is: how can i tell samba to keep more versions of the log
files? Now it only keeps a client.log and a client.log.old.
>
>   
One tack may be to write a script to rename any old files to a 
datestamped file.

If you do this, you end up with
smbd-smith_2007-01-16.log.gz
smbd-smith_2007-01-17.log.gz

Run the script at 11:58 and do the datestring at the start.
Each file will contain the activity of that day.

Alternately,  use  newsyslog. Part of the release with freebsd.  Probably
available for other systems.

# logfilename          [owner:group]    mode count size when [ZJB] 
[/pid_file] [
sig_num]
//var/log/daemon                         644  365   *    $D0   Z
/var/log/maillog                        644  365   *    $D0   Z
/var/log/dns                            644  365   *    $D0   Z

I've not done this with samba log files, as I've not found them useful 
for anything but debugging current problems.  

If you want dailies, then in smb.conf, set the file size for the logs to 
be larger than you would get in a day, or set it to be 0 (unlimited)

The format above names them files name.1 name.2 name.3... and gzips them.

If you prefer a slightly different approach: