Displaying 20 results from an estimated 81 matches for "extd_audit".
2006 Jul 05
1
extd_audit module doesn't write to log.smbd?
Hi all,
I'm using Samba 3.0.14a on Debian Sarge. According to Samba HOWTO,
I've set syslog = 0 to make extd_audit module writes to log.smbd
instead of syslog, but in log.smbd only 1 line about creating new
folder was written. How do I make extd_audit module works as HOWTO
document? Below is my smb.conf file:
#################################################
[global]
server string = %h server (Samba %v)
wor...
2007 Feb 09
0
opendir messages with log level = 1 and extd_audit
Hi,
I'm using samba 3.0.23d on Debian Etch and wat to use the extd_audit vfs
module.
In the global section of my smb.conf I use:
log level = 1 vfs:0
And in the share section:
vfs objects = extd_audit
With log lovel 0 for the vfs module I expected to see messages about
deleted/unlinked files and directories + mkdir commands. In fact I get opendir
messages too. This...
2009 Mar 10
0
samba extd_audit question
Hello All,
i've tried to enable extd_audit on samba 3.0.34, and while it seems to be working fine, i can't figure out why it still insists on logging entries to syslog, even with
syslog=0
log level = 0 vfs:10
log file = log.%U.%m.log
or
syslog=0
log level = 10
log file = log.%U.%m.log
It's very counter intuitive...and qu...
2006 Jul 14
0
Samba vfs extd_audit module and Japanese
Hi all,
I've setup a samba server that use vfs extd_audit module and I got a
problem with Japense file name and folder name. After being written to
syslog, all those Japanese name are changed to
?\226??\201\227?\201\204?\203\225?\202(c)?\203??\203\200
Is there anyone that have same problem? How do I correct it?
Any help would be appreciated.
Best regar...
2005 Feb 08
0
VFS Extended Auditing output situation
Hello,
I'm using Samba 3.0.10 as file server and PDC for some Win2000 Pro
clients, and I'd like to get detailed and clear logs of file/dir
creation/open/save/deletion on some shares. The standard logs are a bit
"too much" for me. The ideal would be a well balanced setting of the
extd_audit VFS module, but when trying, some months ago, I discovered it
behaved differently than expected, see
http://groups-beta.google.com/group/linux.samba/msg/6207c77305925e18
Has anything changed since then?
I'm trying it this very moment, using the following global parameters:
log file =...
2004 Jan 29
1
The 'make install' error
...nstall' after a successful 'make' I get
some error at the end. Is this a bug?. This is samba-3.0.0,
and Solaris 9 Sparc. Thanks
# make install
Installing bin/recycle.so as /usr/local/samba/lib/vfs/recycle.so
Installing bin/audit.so as /usr/local/samba/lib/vfs/audit.so
Installing bin/extd_audit.so as /usr/local/samba/lib/vfs/extd_audit.so
Installing bin/netatalk.so as /usr/local/samba/lib/vfs/netatalk.so
Installing bin/fake_perms.so as /usr/local/samba/lib/vfs/fake_perms.so
Installing bin/default_quota.so as /usr/local/samba/lib/vfs/default_quota.so
Installing bin/readonly.so as /usr/loca...
2004 Sep 23
3
VFS Extended Auditing Module Debug Information
...Class (Log Level) settings and the audit
information each causes to be logged. This will appear in on-line versions of
the Samba-HOWTO-Collection within 24 hours. To obtain an updated version
point your browser at:
http://www.samba.org/samba/docs/Samba-HOWTO-Collection.pdf
The purpose of the extd_audit (Extended Audit) module is to permit logging of
critical file and directory access to BOTH syslog as well as to individual
log files. To create individual log file you can use:
log file = /var/log/samba/%U.%m.log
log level = 0 vfs:[012]
syslog = 0
ie:
log level = 0 vfs:0
or log level = 0 vfs...
2015 Apr 17
3
separate config for dedicate user
...es smbd
1) reads the config completely and then it set the parameters in the process or
2) does smbd reads and set each parameter instantly?
So can I use the following example?
Example:
/etc/samba/smb.conf
=======================================================
[global]
.
.
vfs objects = extd_audit
debug uid = yes
debug pid = yes
debug class = yes
log level = 0 vfs:2
syslog = 0
max log size = 1024
log file = /var/log/smbduserlogs/%U.log
include = /etc/samba/debug/smb.conf.%U
[share1]
path = /data/users/%U
writea...
1997 Nov 14
4
Authentication problems
I am having a problem similar to the one that Jason Gerrity is having
with authentication. Sometimes people are unable to access drives on
one of our unix servers from an NT machine. They are prompted for their
password and when they enter it they get the message "Incorrect password
or unknown username." These are people that have permissions on unix
and can usually access these
2003 Sep 04
2
build samba rpm for redhat 9
...EW.txt Roadmap
/var/tmp/samba-3.0.0rc2-root/usr/share/doc/samba-3.0.0rc2
+ cp -pr docs
/var/tmp/samba-3.0.0rc2-root/usr/share/doc/samba-3.0.0rc2
+ cp -pr examples
/var/tmp/samba-3.0.0rc2-root/usr/share/doc/samba-3.0.0rc2
+ exit 0
Provides: audit.so cap.so config(samba) = 3.0.0rc2-1
default_quota.so extd_audit.so fake_perms.so
libnss_winbind.so libnss_wins.so libsmbclient.so.0
netatalk.so pam_smbpass.so pam_winbind.so
perl(smbldap_conf) = 1.00 perl(smbldap_tools) = 1.00
readonly.so recycle.so samba = 3.0.0rc2
Requires(interp): /bin/sh /bin/sh /bin/sh
Requires(rpmlib): rpmlib(CompressedFileNames) <=
3....
2005 Feb 01
1
SLES9 Module '/usr/lib/samba/vfs/audit.so' loaded, Can't find a vfs module [/usr/lib/samba/vfs/audit.so]
...roups = yes
winbind use default domain = No
oplocks = No
level2 oplocks = No
kernel oplocks = No
guest account = nobody
load printers = no
I had increased log level to 5 for the log snip above.
dan@linfs3:/usr/lib/samba/vfs> ls
audit.so extd_audit.so readonly.so skel_opaque.so
cap.so fake_perms.so recycle.so
skel_transparent.so
default_quota.so full_audit.so shadow_copy.so
expand_msdfs.so netatalk.so shadow_copy_test.so
dan@linfs3:/usr/lib/samba/vfs> rpm -qf audit.so
samba-3.0.9-2.1.5
dan@linfs3:/usr/lib/samba...
2015 Jan 09
1
Question about log file format
Hello and happy new year!
I've a configured logging in the smb.conf as following
vfs objects = extd_audit
debug uid = yes
debug pid = yes
log level = 0 vfs:2
syslog = 0
log file = /var/log/smbduserlogs/%U.log
max log size = 1024
a example of a resulting lines looks like:
[2015/01/08 14:48:48.124825, 2, pid=19808, effective(51002, 100),
real(0, 0)]modules/vfs_extd_audit.c:259(audit_unlink.....
[2015/...
2004 Aug 19
1
File deletion logging
...). Lately, I'm experiencing some problems with malicious
users who are deleting all files in the public share, and I'd like to
know if there is any setting in samba that can log who deleted any file,
and when. I've RTFM, and tried using a higher level of logging, tried
the audit and extd_audit modules, to no avail. Does any of you have a
tip on how could I accomplish this?
Thanks in advance,
Jos? Pinteiro
2004 Sep 22
1
Log level and debug classes
...----------------------------------
How can I know the names of all debug classes available, what they refer
to, and the effect of log levels on them?
My aim is to increase logs regarding file/dir access (e.g. log level = 2
doesn't log creation/deletion of an empty dir, not even when using the
extd_audit VFS module), without having too much useless debug info inside
logs.
Thank you very much in advance.
--
Ciao,
Marco.
..."Refugee", Refugee 1974
2012 Mar 07
1
User audit logging
Hi
I have setup user auditing with extd_audit and its working fine , i
have it logging to log file = /var/log/samba/%U.%m.log and that is
great for identifying the users and machines ...But the syslog entries
don't have a username or host information and I want to use syslog to
ship the logs to a central logging server. Can I configure it...
2019 Oct 30
2
vfs objects
Is the ?important" vfs objects parameter documented in a man page anywhere? It appears in the man pages of several vfs modules, but never fully documented that I could find. Apparently it once was from a now dead link https://www.samba.org/samba/docs/old/Samba3-HOWTO/smb.conf.5.html#VFSOBJECTS <https://www.samba.org/samba/docs/old/Samba3-HOWTO/smb.conf.5.html#VFSOBJECTS> .
Todd
2003 Jul 15
0
samba-3.0.0beta2-1 - network problem???
...003/07/15 11:47:33, 2] lib/access.c:check_access(325)
Allowed connection from (172.24.91.1)
[2003/07/15 11:47:33, 2] lib/module.c:smb_load_module(56)
Module '/usr/lib/samba/vfs/recycle.so' loaded
[2003/07/15 11:47:33, 2] lib/module.c:smb_load_module(56)
Module '/usr/lib/samba/vfs/extd_audit.so' loaded
[2003/07/15 11:47:33, 1] smbd/service.c:make_connection_snum(692)
sv91001 (172.24.91.1) connect to service Dokuser initially as user
administrator (uid=501, gid=100) (pid 3832)
[2003/07/15 11:48:33, 0] lib/fault.c:fault_report(36)
=================================================...
2004 Sep 20
1
Audit
...f, cluttering syslog. Ok, I can use syslog
config to filter user.notice events in a different file, but this does not
prevent syslog from becoming cluttered. Moreover, I tried this, and the
file where I redirected the output grew up to more than 200 MB in a couple
of days! :(
3. I'm now trying extd_audit, but the result seems more or less the same,
if not even worse, as it also clutters Samba logs with its output.
4. I've noticed the presence of a "full_audit" module in my installation,
without any docs. I had a look at the source, it contains some docs, and
it seems interesting, but...
2007 Jan 03
1
Some users can connect and others can't
...dmap gid = 10000-20000
template primary group = "Domain Users"
template shell = /bin/bash
winbind separator = +
printer admin = DOM+phwashington, root-clark, phwashington
hosts allow = 192.168.5., 10.10.9., 192.168.6., 127.
veto files = /.*/lost*/
vfs objects = extd_audit
[Char_Data]
comment = STANDARD DATA
path = /STANDARD_DATA
valid users = "@DOM+Domain Users"
read list = "@DOM+Domain Users"
write list = "@DOM+Domain Users"
read only = No
create mask = 0774
security mask = 0774
force security mode...
2003 Jul 25
0
samba-3.0.0beta2-1 - lost connection to domain controller
...003/07/15 11:47:33, 2] lib/access.c:check_access(325)
Allowed connection from (172.24.91.1)
[2003/07/15 11:47:33, 2] lib/module.c:smb_load_module(56)
Module '/usr/lib/samba/vfs/recycle.so' loaded
[2003/07/15 11:47:33, 2] lib/module.c:smb_load_module(56)
Module '/usr/lib/samba/vfs/extd_audit.so' loaded
[2003/07/15 11:47:33, 1] smbd/service.c:make_connection_snum(692)
sv91001 (172.24.91.1) connect to service Dokuser initially as user
administrator (uid=501, gid=100) (pid 3832)
[2003/07/15 11:48:33, 0] lib/fault.c:fault_report(36)
=================================================...