On Tue, 2021-10-12 at 10:14 +0100, Nick Howitt via samba wrote:> I am running samba-4.10.16-15.el7_9.x86_64 on a simple file server > and > trying to enable auditing of shares. I have a menu entry checkbox > which > allows me to do this but I can't find the logging anywhere. My > smb.conf > is (with default shares pruned): > > Server role: ROLE_DOMAIN_PDCBy no means can you describe a PDC as a simple file server :-D> > > [test] > vfs objects = full_audit:auditTry it like this: vfs objects = full_audit audit Rowland
On 12/10/2021 10:55, Rowland Penny via samba wrote:> > By no means can you describe a PDC as a simple file server :-D >Sorry. ClearOS terminology :S>> >> >> [test] >> vfs objects = full_audit:audit > > Try it like this: > > vfs objects = full_audit auditHmm. That logs a single line: Oct 12 11:06:50 microserver smbd_audit[18821]: connect to service test by user test1 It I do the edits I described I get a lot more when opening, creating and deleting files: Oct 12 11:17:48 microserver smbd_audit: test1|stat|fail (No such file or directory)|/var/flexshare/shares/test/subdolder/New folder Oct 12 11:17:48 microserver smbd_audit: test1|stat|fail (No such file or directory)|/var/flexshare/shares/test/subdolder/New folder Oct 12 11:17:48 microserver smbd_audit: test1|opendir|ok|. Oct 12 11:17:48 microserver smbd_audit: test1|realpath|fail (No such file or directory)|subdolder/New folder Oct 12 11:17:48 microserver smbd_audit: test1|create_file|fail (No such file or directory)|0x100080|file|open|/var/flexshare/shares/test/subdolder/New folder Oct 12 11:17:48 microserver smbd_audit: test1|open|ok|r|/var/flexshare/shares/test/subdolder Oct 12 11:17:48 microserver smbd_audit: test1|open|ok|r|/var/flexshare/shares/test/subdolder Oct 12 11:17:48 microserver smbd_audit: test1|readdir_attr|fail (Operation not supported)|/var/flexshare/shares/test/subdolder/. Oct 12 11:17:48 microserver smbd_audit: test1|getxattr|fail (No data available)|subdolder/..|user.DOSATTRIB Oct 12 11:17:48 microserver smbd_audit: test1|get_dos_attributes|fail (No data available)|/var/flexshare/shares/test/subdolder/.. Oct 12 11:17:48 microserver smbd_audit: test1|readdir_attr|fail (No data available)|/var/flexshare/shares/test/subdolder/.. Oct 12 11:17:48 microserver smbd_audit: test1|readdir_attr|fail (Operation not supported)|/var/flexshare/shares/test/subdolder/990 Oct 12 11:17:48 microserver smbd_audit: test1|readdir_attr|fail (Operation not supported)|/var/flexshare/shares/test/subdolder/njh Oct 12 11:17:48 microserver smbd_audit: test1|readdir_attr|fail (Operation not supported)|/var/flexshare/shares/test/subdolder/clearos.reg Oct 12 11:17:48 microserver smbd_audit: test1|open|ok|r|/var/flexshare/shares/test/subdolder Oct 12 11:17:48 microserver smbd_audit: test1|open|ok|r|/var/flexshare/shares/test/subdolder Oct 12 11:17:48 microserver smbd_audit: test1|readdir_attr|fail (Operation not supported)|/var/flexshare/shares/test/subdolder/. Oct 12 11:17:48 microserver smbd_audit: test1|getxattr|fail (No data available)|subdolder/..|user.DOSATTRIB Oct 12 11:17:48 microserver smbd_audit: test1|get_dos_attributes|fail (No data available)|/var/flexshare/shares/test/subdolder/.. Oct 12 11:17:48 microserver smbd_audit: test1|readdir_attr|fail (No data available)|/var/flexshare/shares/test/subdolder/.. Oct 12 11:17:48 microserver smbd_audit: test1|readdir_attr|fail (Operation not supported)|/var/flexshare/shares/test/subdolder/990 Oct 12 11:17:48 microserver smbd_audit: test1|readdir_attr|fail (Operation not supported)|/var/flexshare/shares/test/subdolder/njh Oct 12 11:17:48 microserver smbd_audit: test1|readdir_attr|fail (Operation not supported)|/var/flexshare/shares/test/subdolder/clearos.reg Oct 12 11:17:48 microserver smbd_audit: test1|open|ok|r|/var/flexshare/shares/test/subdolder Oct 12 11:17:48 microserver smbd_audit: test1|open|ok|r|/var/flexshare/shares/test/subdolder Oct 12 11:17:48 microserver smbd_audit: test1|readdir_attr|fail (Operation not supported)|/var/flexshare/shares/test/subdolder/. Oct 12 11:17:48 microserver smbd_audit: test1|getxattr|fail (No data available)|subdolder/..|user.DOSATTRIB Oct 12 11:17:48 microserver smbd_audit: test1|get_dos_attributes|fail (No data available)|/var/flexshare/shares/test/subdolder/.. Oct 12 11:17:48 microserver smbd_audit: test1|readdir_attr|fail (No data available)|/var/flexshare/shares/test/subdolder/.. Oct 12 11:17:48 microserver smbd_audit: test1|readdir_attr|fail (Operation not supported)|/var/flexshare/shares/test/subdolder/990 Oct 12 11:17:48 microserver smbd_audit: test1|readdir_attr|fail (Operation not supported)|/var/flexshare/shares/test/subdolder/njh Oct 12 11:17:48 microserver smbd_audit: test1|readdir_attr|fail (Operation not supported)|/var/flexshare/shares/test/subdolder/clearos.reg Oct 12 11:17:48 microserver smbd_audit: test1|open|ok|r|/var/flexshare/shares/test Oct 12 11:17:48 microserver smbd_audit: test1|getxattr|fail (No data available)|.|user.DOSATTRIB Oct 12 11:17:48 microserver smbd_audit: test1|get_dos_attributes|fail (No data available)|/var/flexshare/shares/test Oct 12 11:17:48 microserver smbd_audit: test1|readdir_attr|fail (No data available)|/var/flexshare/shares/test Oct 12 11:17:48 microserver smbd_audit: test1|getxattr|fail (No data available)|..|user.DOSATTRIB Oct 12 11:17:48 microserver smbd_audit: test1|get_dos_attributes|fail (No data available)|/var/flexshare/shares/test/.. Oct 12 11:17:48 microserver smbd_audit: test1|readdir_attr|fail (No data available)|/var/flexshare/shares/test/.. Oct 12 11:17:48 microserver smbd_audit: test1|getxattr|fail (No data available)|990|user.DOSATTRIB Oct 12 11:17:48 microserver smbd_audit: test1|get_dos_attributes|fail (No data available)|/var/flexshare/shares/test/990 Oct 12 11:17:48 microserver smbd_audit: test1|readdir_attr|fail (No data available)|/var/flexshare/shares/test/990 Oct 12 11:17:48 microserver smbd_audit: test1|getxattr|fail (No data available)|logon.cmd|user.DOSATTRIB Oct 12 11:17:48 microserver smbd_audit: test1|get_dos_attributes|fail (No data available)|/var/flexshare/shares/test/logon.cmd Oct 12 11:17:48 microserver smbd_audit: test1|readdir_attr|fail (No data available)|/var/flexshare/shares/test/logon.cmd Oct 12 11:17:48 microserver smbd_audit: test1|getxattr|fail (No data available)|.trash|user.DOSATTRIB Oct 12 11:17:48 microserver smbd_audit: test1|get_dos_attributes|fail (No data available)|/var/flexshare/shares/test/.trash Oct 12 11:17:48 microserver smbd_audit: test1|readdir_attr|fail (No data available)|/var/flexshare/shares/test/.trash Oct 12 11:17:48 microserver smbd_audit: test1|readdir_attr|fail (Operation not supported)|/var/flexshare/shares/test/subdolder Oct 12 11:17:48 microserver smbd_audit: test1|readdir_attr|fail (Operation not supported)|/var/flexshare/shares/test/21 Nick