Stefan G. Weichinger
2019-Sep-23 10:29 UTC
[Samba] using vfs module full_audit: longer history?
A customer asked "who deleted file X?" and I noticed that my current setup only gives me about 4 days of log history ... Debian uses systemd which runs journald, so I know to use journald.conf to increase the log file size etc Any way to specifically increase only the history size for that auditing module (and not for all the other systemd units)?
Stefan G. Weichinger
2019-Sep-23 12:52 UTC
[Samba] using vfs module full_audit: longer history?
Am 23.09.19 um 12:29 schrieb Stefan G. Weichinger via samba:> > A customer asked "who deleted file X?" and I noticed that my current > setup only gives me about 4 days of log history ... > > Debian uses systemd which runs journald, so I know to use journald.conf > to increase the log file size etc > > Any way to specifically increase only the history size for that auditing > module (and not for all the other systemd units)?on my way there with some rsyslog-filtering.
Stefan G. Weichinger
2019-Sep-24 07:49 UTC
[Samba] using vfs module full_audit: longer history?
Am 23.09.19 um 14:52 schrieb Stefan G. Weichinger via samba:> Am 23.09.19 um 12:29 schrieb Stefan G. Weichinger via samba: >> >> A customer asked "who deleted file X?" and I noticed that my current >> setup only gives me about 4 days of log history ... >> >> Debian uses systemd which runs journald, so I know to use journald.conf >> to increase the log file size etc >> >> Any way to specifically increase only the history size for that auditing >> module (and not for all the other systemd units)? > > on my way there with some rsyslog-filtering.Is it possible to write one audit-file per share?