search for: eventlogadm

Because my debian sarge dist doesn't have eventlogadm i download the source and compile it. I follow the instructions on http://wiki.samba.org/index.php/Event_Logging and insert the line eventlog list = Application, System, Security, SyslogLinux in smb.conf in the main - section. But when i start the command tail -f /var/log/syslog | /usr/sbin/par...

Dear list, I compiled Samba 3.2.0 document like this. cd samba-3.2.0/source configure ... ... ... cd ../docs-xml make all but some error happen. --------------------------------- # make all ... ... xsltproc --output output/manpages-3/eventlogadm.8 xslt/man.xsl tmp/manpages-3/eventlogadm.8.xml runtime error: file xslt/man.xsl line 41 element if unregistered variable list-indent xmlXPathCompOpEval: parameter error xmlXPathCompiledEval: evaluation failed make: *** [output/manpages-3/eventlogadm.8] Error 10 What happen? -- --- Oota Toshiya -...

...//wiki.samba.org/index.php/Event_Logging Here's what I think I understand from that article: 1) Tell samba which event log 'names' to create (and somehow report to the Ms. EventViewer); 2) Find/develop a program to read the traditional samba log files, convert them to a format that eventlogadm accepts, and then 3) pipe them to eventlogadm, which will record them in the tdb files that were created as a result of point 1) above. If that's correct, does anyone know of a program to use for point 2)? I can't find any examples on google. Also, assuming I find one, or write my own...

...atic=yes --with-included-popt -------- $ gcc -v Reading specs from /usr/local/lib/gcc-lib/sparc-sun-solaris2.7/3.0.3/specs Configured with: ../configure --with-as=/usr/local/bin/as --with-ld=/usr/local/bin/ld Thread model: posix gcc version 3.0.3 ----------------------------- ... Compiling utils/eventlogadm.c Linking bin/eventlogadm Compiling nsswitch/wbinfo.c Linking bin/wbinfo Compiling nsswitch/wb_common.c with -fPIC Compiling lib/replace1.c with -fPIC Compiling nsswitch/winbind_nss_solaris.c with -fPIC nsswitch/winbind_nss_solaris.c: In function `parse_response': nsswitch/winbind_nss_solaris.c...

...atic=yes --with-included-popt -------- $ gcc -v Reading specs from /usr/local/lib/gcc-lib/sparc-sun-solaris2.7/3.0.3/specs Configured with: ../configure --with-as=/usr/local/bin/as --with-ld=/usr/local/bin/ld Thread model: posix gcc version 3.0.3 ----------------------------- ... Compiling utils/eventlogadm.c Linking bin/eventlogadm Compiling nsswitch/wbinfo.c Linking bin/wbinfo Compiling nsswitch/wb_common.c with -fPIC Compiling lib/replace1.c with -fPIC Compiling nsswitch/winbind_nss_solaris.c with -fPIC nsswitch/winbind_nss_solaris.c: In function `parse_response': nsswitch/winbind_nss_solaris.c...

...ba.org> wrote: On Tue, 2018-09-11 at 15:14 +0000, ray klassen via samba wrote: >   > Yes, after further research the solution could possibly be to create > a python script to monitor the json output in log.samba and push out > eventlog formatted events to 'Security' with eventlogadm. Seems a lot > of work. That still assumes the appliance is reading the same type of event log (because the eventlog RPC service was superseeded by eventlog6 and the WMI thin, which is the reason I asked for details).  > The appliance in question also supports getting the necessary info &gt...

Yes, after further research the solution could possibly be to create a python script to monitor the json output in log.samba and push out eventlog formatted events to 'Security' with eventlogadm. Seems a lot of work. The appliance in question also supports getting the necessary info via the netapi call "netsessionenum" I have tried that and a wireshark dump shows samba replying with WERR_INVALID_LEVEL. if you could shed any light on that, I would appreciate it. On Monday, 1...

...nking bin/rpcclient Compiling utils/smbcacls.c Linking bin/smbcacls Compiling utils/profiles.c Linking bin/profiles Compiling utils/ntlm_auth.c Compiling utils/ntlm_auth_diagnostics.c Compiling libsmb/spnego.c Linking bin/ntlm_auth Compiling utils/smbcquotas.c Linking bin/smbcquotas Compiling utils/eventlogadm.c Linking bin/eventlogadm Compiling client/smbmount.c Linking bin/smbmount Compiling client/smbmnt.c Linking bin/smbmnt client/smbmnt.o(.text+0x8d9): In function `main': client/smbmnt.c:296: undefined reference to `swrap_close' collect2: ld returned 1 exit status make: *** [bin/smbmnt] Erro...

...sizes. I'm not sure all of these are really part of Samba, but they all got added as a result of adding the OE Samba package. They add up to about 83MB, and if I could cut that in half, that would be a big win. Any guidance as to what I could prune would be greatly appreciated. 1800096 usr/bin/eventlogadm 4607 usr/bin/findsmb 8351180 usr/bin/net 1526820 usr/bin/nmblookup 1826880 usr/bin/pdbedit 1465348 usr/bin/profiles 7457348 usr/bin/rpcclient 1440772 usr/bin/sharesec 5946532 usr/bin/smbcacls 5979364 usr/bin/smbclient 1465604 usr/bin/smbcontrol 5942436 usr/bin/smbcquotas 6200476 usr/bin/smbget 5...

...ing error occurs: Event Viewer cannot connect to computer 'XXXXXX'. The error reported is : The RPC server is unavailable. Clicking OK allows me to proceed. To get rid of the message I've tried configuring an event log and saving a message. Accessing the log information locally using eventlogadm seems to work. Using rpcclient I can get the number of log entries. Other commands don't generate errors but don't output any information. Running rpcclient eventlog commands with debug 10 shows a lot of appropriate looking activity. Running a packet trace while loading the event viewer on...

...+0000, ray klassen via samba wrote: > > > >   > > Yes, after further research the solution could possibly be to > > create > > a python script to monitor the json output in log.samba and push > > out > > eventlog formatted events to 'Security' with eventlogadm. Seems a > > lot > > of work. > That still assumes the appliance is reading the same type of event > log > (because the eventlog RPC service was superseeded by eventlog6 and > the > WMI thin, which is the reason I asked for details).  > > > > > The applia...

On Tue, 2018-09-11 at 15:14 +0000, ray klassen via samba wrote: >   > Yes, after further research the solution could possibly be to create > a python script to monitor the json output in log.samba and push out > eventlog formatted events to 'Security' with eventlogadm. Seems a lot > of work. That still assumes the appliance is reading the same type of event log (because the eventlog RPC service was superseeded by eventlog6 and the WMI thin, which is the reason I asked for details).  > The appliance in question also supports getting the necessary info &gt...

we have recently purchased a security appliance that wants to poll the DC's for login info (ipaddress:logged-in-user) to give more granular access to internet resources this seems possible with samba 4.8.4 my smb.conf     log level = 1 auth_audit:3     eventlog list = Application System Security SyslogLinux It doesn't look like audit events are ending up in

...+0000, ray klassen via samba wrote: > > > >   > > Yes, after further research the solution could possibly be to > > create > > a python script to monitor the json output in log.samba and push > > out > > eventlog formatted events to 'Security' with eventlogadm. Seems a > > lot > > of work. > That still assumes the appliance is reading the same type of event > log > (because the eventlog RPC service was superseeded by eventlog6 and > the > WMI thin, which is the reason I asked for details).  > > > > > The applia...

...I have a RHEL5-update 3 x86_64 system, and I installed Samba 3.2.14-40 (from http://ftp.sernet.com/pub/samba/tested/rhel/5/x86_64/ ). I'm using OpenLDAP ( 2.3.43-3.el5 ,comes with RHEL5u3) as backend for winbind+samba in my PDC. With samba-3.0.33 that comes with RHEL5u3, i dont get that "eventlogadm" works how explain in http://wiki.samba.org/index.php/Event_Logging: For this reason I upgraded samba to 3.2.14-40. And now, all works fine. I have read http://wiki.samba.org/index.php/Ldapsam_Editposix and i noticed the last section: "Managing your DB". Then, I have read "Ore...

.../smbspool Linking bin/testparm Linking bin/smbstatus Linking bin/smbget Linking bin/smbcontrol Linking bin/smbtree Linking bin/nmblookup Linking bin/pdbedit Linking bin/smbpasswd Linking bin/rpcclient Linking bin/smbcacls Linking bin/profiles Linking bin/ntlm_auth Linking bin/smbcquotas Linking bin/eventlogadm Linking bin/wbinfo Compiling nsswitch/pam_winbind.c with -O2 nsswitch/pam_winbind.c: In function `converse': nsswitch/pam_winbind.c:76: warning: passing arg 3 of `pam_get_item' from incompatible pointer type nsswitch/pam_winbind.c:79: warning: passing arg 2 of pointer to function from incom...

...--------------------- Size of binaries in usr/bin: 46 MB ----------------------------------------- Wodan:[toolchain]:/tmp/root/usr/bin$ ls -alh total 46M drwxr-xr-x 2 mmnet mmnet 4.0K 2009-10-10 19:14 . drwxr-xr-x 7 mmnet mmnet 4.0K 2009-10-10 19:14 .. -rwxr-xr-x 1 mmnet mmnet 798K 2009-10-10 19:14 eventlogadm -rwxr-xr-x 1 mmnet mmnet 4.5K 2009-10-10 19:14 findsmb -rwxr-xr-x 1 mmnet mmnet 860K 2009-10-10 19:14 ldbadd -rwxr-xr-x 1 mmnet mmnet 860K 2009-10-10 19:14 ldbdel -rwxr-xr-x 1 mmnet mmnet 862K 2009-10-10 19:14 ldbedit -rwxr-xr-x 1 mmnet mmnet 860K 2009-10-10 19:14 ldbmodify -rwxr-xr-x 1 mmnet mmnet...

...ith SMB2. * BUG 13563: s3/smbd: Ensure quota code is only called when quota support detected. o Anoop C S <anoopcs at redhat.com> * BUG 13204: s3/libsmb: Explicitly set delete_on_close token for rmdir. o Andreas Schneider <asn at samba.org> * BUG 13561: s3:waf: Install eventlogadm to /usr/sbin. o Justin Stephenson <jstephen at redhat.com> * BUG 13562: Shorten description in vfs_linux_xfs_sgid manual. CHANGES SINCE 4.9.0rc1 ====================== o Jeremy Allison <jra at samba.org> * BUG 13537: s3: smbd: Using "sendfile = yes" with SMB2 can...

...ith SMB2. * BUG 13563: s3/smbd: Ensure quota code is only called when quota support detected. o Anoop C S <anoopcs at redhat.com> * BUG 13204: s3/libsmb: Explicitly set delete_on_close token for rmdir. o Andreas Schneider <asn at samba.org> * BUG 13561: s3:waf: Install eventlogadm to /usr/sbin. o Justin Stephenson <jstephen at redhat.com> * BUG 13562: Shorten description in vfs_linux_xfs_sgid manual. CHANGES SINCE 4.9.0rc1 ====================== o Jeremy Allison <jra at samba.org> * BUG 13537: s3: smbd: Using "sendfile = yes" with SMB2 can...

...ith SMB2. * BUG 13563: s3/smbd: Ensure quota code is only called when quota support detected. o Anoop C S <anoopcs at redhat.com> * BUG 13204: s3/libsmb: Explicitly set delete_on_close token for rmdir. o Andreas Schneider <asn at samba.org> * BUG 13561: s3:waf: Install eventlogadm to /usr/sbin. o Justin Stephenson <jstephen at redhat.com> * BUG 13562: Shorten description in vfs_linux_xfs_sgid manual. CHANGES SINCE 4.9.0rc1 ====================== o Jeremy Allison <jra at samba.org> * BUG 13537: s3: smbd: Using "sendfile = yes" with SMB2 can...