samba - Sep 2008 - loging user actions

Hallo,

from time to time some of our users delete files. But none of them do
confess that they have deleted the file.
I want to find at the samba logs which user has deleted the file. I´m
using the audit-vfs module but there are only messages about opening
and closing of files.
Can anybody give me a hint for using samba logs to find the users I´m
searching for?

Thanks in advance

Peter

On Sat, Sep 20, 2008 at 09:41:55PM +0200, peter grotz
wrote:
> from time to time some of our users delete files. But none of them do
> confess that they have deleted the file.
> I want to find at the samba logs which user has deleted the file. I?m
> using the audit-vfs module but there are only messages about opening
> and closing of files.
> Can anybody give me a hint for using samba logs to find the users I?m
> searching for?
Look for the full_audit module.

Volker
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: not available
Url :
http://lists.samba.org/archive/samba/attachments/20080920/bb5aba0a/attachment.bin

> from time to time some of our users delete files. But none of them do
> confess that they have deleted the file. I want to find at the samba 
> logs which user has deleted the file. I?m using the audit-vfs module 
> but there are only messages about opening and closing of files. Can 
> anybody give me a hint for using samba logs to find the users I?m
> searching for?
This is not a direct answer to your question, but rather a suggestion of a
different strategy that might resolve your underlying problem:

At a combined middle/high school we implemented vfs-recycle, so our deleted
files aren't "really" deleted but rather are moved to a network
trash can (which we then regularly trim with 'find' really removing
files that haven't been touched in a week). Our requests related to deleted
files (why?, please access your backup, etc.) went to ZERO. Our students (who
are notoriously impulsive and forgetful) don't ever ask us where a file went
any more.

We found the vfs-recycle strategy works incredibly well for us. We have a second
backup mechanism also, but in the last couple of years it's never ever been
used nor even investigated. As far as our user students are concerned, the
vfs-recycle by itself takes care of all their problems.
 
-Chuck Kollars