samba - Oct 2019 - splitting/duplicating log files - how?

hi everyone

I'd like to ask, with having basic logging in config as here:
?
? log file = /var/log/samba/log.%m
? max log size = 5000
? log level = 1 auth:3 tdb:5 passdb:3 sam:3 winbind:0 idmap:3

log files get populated on per-machine basis.

Would it be possible to put all authentication into one separate file
simultaneously?

many thanks, L.

On 15/10/2019 10:29, lejeczek via samba wrote:
> hi everyone
>
> I'd like to ask, with having basic logging in config as here:
>   
>  ? log file = /var/log/samba/log.%m
>  ? max log size = 5000
>  ? log level = 1 auth:3 tdb:5 passdb:3 sam:3 winbind:0 idmap:3
>
> log files get populated on per-machine basis.
>
> Would it be possible to put all authentication into one separate file
> simultaneously?
>
> many thanks, L.
>
Never felt the need to do it myself, but smb.conf says this under 'log 
level':

To configure the logging for specific classes to go into a different 
file then log file, you can append @PATH to the class, eg log level = 1 
full_audit:1@/var/log/audit.log.

Rowland

On 15/10/2019 10:54, Rowland penny via samba wrote:
> On 15/10/2019 10:29, lejeczek via samba wrote:
>> hi everyone
>>
>> I'd like to ask, with having basic logging in config as here:
>> ? ?? log file = /var/log/samba/log.%m
>> ?? max log size = 5000
>> ?? log level = 1 auth:3 tdb:5 passdb:3 sam:3 winbind:0 idmap:3
>>
>> log files get populated on per-machine basis.
>>
>> Would it be possible to put all authentication into one separate file
>> simultaneously?
>>
>> many thanks, L.
>>
> Never felt the need to do it myself, but smb.conf says this under 'log
> level':
>
> To configure the logging for specific classes to go into a different
> file then log file, you can append @PATH to the class, eg log level > 1
full_audit:1@/var/log/audit.log.
>
> Rowland
>
>
>
For some reason @$a_path does not work me(Version 4.9.1), the file does
not get created.

I think I can see an effect of auth_audit as more details go into the
logs now with 'log level = 1 auth_audit:2@/var/log/samba/auth.log, like
IPs which were not there before, eg.:

Oct 15 16:12:00 swi smbd[377337]:? Auth: [SMB2,(null)] user
[NNR_BI\[mee] at [Tue, 15 Oct 2019 16:12:00.610569 BST] with [NTLMv2]
status [NT_STATUS_WRONG_PASSWORD] workstation [NNRDC] remote host
[ipv4:10.5.5.202:36784] mapped to [NNR_BI\[mee]. local host
[ipv4:10.5.5.204:445]

but no /var/log/samba/auth.log

many thanks, L.