samba - Mar 2017 - I need to log user logon and logoff

I need to log to a separated file just user/computer logon and logoff.

I would like not to use log level > 2 to do this.

I have tried using vfs_full_audit but it works well into shares 
definitions.

I don't care if the user access a shared directory, I just need to 
record user login and logoff.

Thanks

Although I don't know the solution, I'll help you formulate a better
quality question.

What version of Samba Server are you running?
What client computers are connecting?
Is Samba running in Active Directory mode, or in a PDC (NT4) mode?
Do you have at least one extra Domain Controller as well?

On Tue, Mar 21, 2017 at 8:05 AM, Denis Morejon via samba <
samba at lists.samba.org> wrote:
> I need to log to a separated file just user/computer logon and logoff.
>
> I would like not to use log level > 2 to do this.
>
> I have tried using vfs_full_audit but it works well into shares
> definitions.
>
> I don't care if the user access a shared directory, I just need to
record
> user login and logoff.
>
> Thanks
>
>
> --
> To unsubscribe from this list go to the following URL and read the
> instructions:  https://lists.samba.org/mailman/options/samba
>

On Tue, 2017-03-21 at 10:05 -0500, Denis Morejon via samba
wrote:
> I need to log to a separated file just user/computer logon and
> logoff.
> 
> I would like not to use log level > 2 to do this.
> 
> I have tried using vfs_full_audit but it works well into shares 
> definitions.
> 
> I don't care if the user access a shared directory, I just need to 
> record user login and logoff.
This will be much easier once the auth logging patch, which I'm working
on right now with Gary Lockyer lands.  

It will be in Samba 4.7.

User log-off is harder to log, but user logon will be well tracked. 

Thanks,

Andrew Bartlett

On 3/21/2017 5:44 PM, Andrew Bartlett via samba wrote:
> On Tue, 2017-03-21 at 10:05 -0500, Denis Morejon via samba wrote:
>> I need to log to a separated file just user/computer logon and
>> logoff.
>>
>> I would like not to use log level > 2 to do this.
>>
>> I have tried using vfs_full_audit but it works well into shares
>> definitions.
>>
>> I don't care if the user access a shared directory, I just need to
>> record user login and logoff.
> This will be much easier once the auth logging patch, which I'm working
> on right now with Gary Lockyer lands.
>
> It will be in Samba 4.7.
>
> User log-off is harder to log, but user logon will be well tracked.
>
> Thanks,
>
> Andrew Bartlett
If you're referring to logging on to a samba share, you can use the 
preexec configuration parameter in smb.conf with a custom script to do 
the actuall logging.  It only logs the logon, not the logoff. This is 
what I have in my smb.conf.

    preexec = /usr/local/bin/loguser.sh "%I,%m,%U,%T,%M,%a,%D,%h,%S"


And this is the script that does the logging, loguser.sh:

    #!/bin/sh

    # This script is run from the preeexec option in smb.conf

    /bin/echo -E "$@" >> /var/tmp/login.log

    # END

Joe Zacky