Ralf Gross
2007-Feb-09 13:49 UTC
[Samba] opendir messages with log level = 1 and extd_audit
Hi, I'm using samba 3.0.23d on Debian Etch and wat to use the extd_audit vfs module. In the global section of my smb.conf I use: log level = 1 vfs:0 And in the share section: vfs objects = extd_audit With log lovel 0 for the vfs module I expected to see messages about deleted/unlinked files and directories + mkdir commands. In fact I get opendir messages too. This is filling up the logfile rather quickly. [2007/02/09 13:32:48, 1] modules/vfs_extd_audit.c:audit_opendir(164) vfs_extd_audit: opendir tmp [2007/02/09 13:32:48, 1] modules/vfs_extd_audit.c:audit_opendir(164) vfs_extd_audit: opendir ./>From http://us4.samba.org/samba/docs/man/Samba-HOWTO-Collection/VFS.html:### * extd_audit This module is identical with the audit module above except that it sends audit logs to both syslog as well as the smbd log files. The log level for this module is set in the smb.conf file. Valid settings and the information that will be recorded are shown in the next table. Table 23.1. Extended Auditing Log Information Log Level Log Details - File and Directory Operations 0 Make Directory, Remove Directory, Unlink 1 Open Directory, Rename File, Change Permissions/ACLs 2 Open & Close File 10 Maximum Debug Level ### Is it the expected behaviour that extd_audit logs the opendir commands? I found a bug report about this with the comment that "the ext_audit module works as designed". https://bugzilla.samba.org/show_bug.cgi?id=1950 I'm now plying around with the full_audit option, but it seems to be poorly documented. Ralf
Possibly Parallel Threads
- 3.0.23 - different errors on solaris 8 (Error in dskattr...)
- Odd Disconnect problem, again. (Recv failure for 4?)
- VFS Extended Auditing Module Debug Information
- Project: writing a vfs module to preverse permissions with MS Office
- extd_audit module doesn't write to log.smbd?