Hi,
We're using json logging on the DCs for authentication logging. This
makes extraction in our log aggregation tool very easy.
We're also using vfs_full_audit logging on the member servers.
The full_audit logs are not json formatted, but look like this:
> 2021-03-15T16:47:39.691012+01:00 memberserver smbd_audit - - -
> IP=192.168.89.5 | USER=DOM\username | MACHINE=desktop-js8pb3b |
> VOLUME=username|getxattr|fail (No data
> available)|/home/username|user.DOSATTRIB
(i prefixed the generated logs with "IP=%I | MACHINE=%m | VOLUME=%S")
Is there a way to get nice json formatted logs out of the vfs_full_audit
module?
I read this page, and it does not mention json at all:
https://www.samba.org/samba/docs/current/man-html/vfs_full_audit.8.html
We're on 4.13.5, and of course I can provide a complete smb.conf if
required.
Thanks,
MJ