Folks,
I tried using full_audit on Samba 3.0.28 by putting the following
lines on smb.conf (global section):
vfs objects = full_audit
full_audit:facility = LOCAL2
full_audit:priority = WARN
full_audit:prefix = %u|%m|%S
full_audit:success = rename rmdir unlink write
full_audit:failure = none
My log says:
Dec 29 13:57:07 lua smbd_audit: [2008/12/29 13:57:07, 0]
lib/fault.c:fault_report(45)
Dec 29 13:57:07 lua smbd_audit:
==============================================================Dec 29 13:57:07
lua smbd_audit: [2008/12/29 13:57:07, 0]
lib/util.c:smb_panic(1655)
Dec 29 13:57:07 lua smbd_audit: PANIC (pid 11846): internal error
Dec 29 13:57:07 lua smbd_audit: [2008/12/29 13:57:07, 0]
lib/util.c:log_stack_trace(1759)
Dec 29 13:57:07 lua smbd_audit: BACKTRACE: 16 stack frames:
Dec 29 13:57:07 lua smbd_audit: #0 smbd(log_stack_trace+0x2d) [0x599edd]
Dec 29 13:57:07 lua smbd_audit: #1 smbd(smb_panic+0x5d) [0x59a00d]
Dec 29 13:57:07 lua smbd_audit: #2 smbd [0x584b9a]
Dec 29 13:57:07 lua smbd_audit: #3 [0xf99420]
Dec 29 13:57:07 lua smbd_audit: #4 smbd(StrCaseCmp+0x1a) [0x5916ba]
Dec 29 13:57:07 lua smbd_audit: #5 smbd(strequal+0x35) [0x591925]
Dec 29 13:57:07 lua smbd_audit: #6 smbd(lp_parm_enum+0x6b) [0x3ab5ab]
Dec 29 13:57:07 lua smbd_audit: #7 /usr/lib/samba/vfs/full_audit.so
[0xdde487]
Dec 29 13:57:07 lua smbd_audit: #8 /usr/lib/samba/vfs/full_audit.so
[0xde0b5c]
Dec 29 13:57:07 lua smbd_audit: #9 smbd(rename_internals+0x118f) [0x3e5d5f]
Dec 29 13:57:07 lua smbd_audit: #10 smbd(reply_mv+0x2cb) [0x3e636b]
Dec 29 13:57:07 lua smbd_audit: #11 smbd [0x41ad90]
Dec 29 13:57:07 lua smbd_audit: #12 smbd(smbd_process+0x836) [0x41be26]
Dec 29 13:57:07 lua smbd_audit: #13 smbd(main+0xbdd) [0x6773ad]
Dec 29 13:57:07 lua smbd_audit: #14
/lib/libc.so.6(__libc_start_main+0xdc) [0x956dec]
Dec 29 13:57:07 lua smbd_audit: #15 smbd [0x39f3a1]
Dec 29 13:57:07 lua smbd_audit: [2008/12/29 13:57:07, 0]
lib/fault.c:dump_core(181)
Dec 29 13:57:07 lua smbd_audit: dumping core in /var/log/samba/cores/smbd
Dec 29 13:57:07 lua smbd_audit:
Actually no core is saved on /var/log/samba/cores/smbd, so I cannot
even try to debug it.
Any advices?
Thanks a lot!
CentOS release 5.2 (Final)
samba-3.0.28-1.el5_2.1
samba-client-3.0.28-1.el5_2.1
samba-swat-3.0.28-1.el5_2.1
system-config-samba-1.2.39-1.el5
samba-common-3.0.28-1.el5_2.1
--
Fabiano Caixeta Duarte
Especialista em Redes de Computadores
Linux User #195299
Ribeir?o Preto - SP
2009/1/5 Volker Lendecke
<Volker.Lendecke@sernet.de>:> On Mon, Jan 05, 2009 at 02:21:53PM -0200, Fabiano Caixeta Duarte wrote:
>> I tried using full_audit on Samba 3.0.28 by putting the following lines
on
>> smb.conf (global section):
>
> Try to run it under valgrind and with debugging symbols
> included.
>
> Thanks,
>
> Volker
>
Sorry for huge delay. Couldn't avoid it.
Please, how should I run it?
Just valgrind smbd?
Actually, I had never heard of it before.
--
Fabiano Caixeta Duarte
Especialista em Redes de Computadores
Linux User #195299
Ribeir?o Preto - SP