similar to: Bug#452879: Logcheck doesn't ignore smbd_audit logs

# Automatically generated email from bts, devscripts version 2.10.30 # via tagpending # # logcheck (1.2.65) unstable; urgency=low # # * ignore.d.server/courier: # - update rules to include port information; thanks to Antoine Pardignon # (closes: #446310). # - ignore couriertcpd messages; thanks to Andrew Gallagher # (closes: #451118). # * ignore.d.server/smbd_audit: # -

*This message was transferred with a trial version of CommuniGate(r) Pro* Greetings, aLL. There's samba-3.0.23d, running on FreeBSD-5.3 as Win2000 AD domain member. For logging user activity on share VFS module full_audit is used (with help of syslog). Logging works well, but some errors appears in log, especially when changing ACLs on share file objects from win-clients: === Nov 30

hello I'm using Samba 3.0.21b-2 on RHEL4.1. All the machines are logging to a windows 2003 ADS domain server. The samba server is a ADS member of this windows 2k3 server and user's access log is recorded by using the audit module. I recently came into this trouble, when I connect to samba server from client, the smbd_audit suddenly got panic. Please advise me how to solve this

Hello my name is Piercarlo and I've discovered a bug in smbd_audit when I trace a Samba 2.2.7 or 2.2.7a on red hat 7.3 -the error exist on the redhat 2.4.18-17kernel ,on the original rh73 2.4.18-3 kernel and on the standard linus kernel (I tried on 2.4.20)-->these kernels are all the kernels that I tried. This error appear when samba is configured as pdc with the roaming of the users

Hello alAl, after update of our test server to 4.12.1 from 4.11 it crashes. If the vfs module is removed from the config everthing works as before. Logs from the crash see here: .0.31:445] Apr 16 13:36:47 lx-sv-03 smbd_audit[6263]: [2020/04/16 13:36:47.546559, 0] ../../source3/lib/util.c:830(smb_panic_s3) Apr 16 13:36:47 lx-sv-03 smbd_audit[6263]: PANIC (pid 6263): vfs_full_audit.c: name table

Hi all Is anyone using the audit.so module ? I've compiled it and added the appropriate line to smb.conf but I seem to be having a few issues... Here is an snip from syslog... May 13 18:12:44 netvault.crcert.unsw.edu.au smbd_audit[13474]: opendir ./ May 13 18:12:44 netvault.crcert.unsw.edu.au smbd_audit[13474]: opendir . May 13 18:12:50 netvault.crcert.unsw.edu.au smbd_audit[13474]: opendir .

Hi all Is anyone using the audit.so module ? I've compiled it and added the appropriate line to smb.conf but I seem to be having a few issues... Here is an snip from syslog... May 13 18:12:44 myhost.com smbd_audit[13474]: opendir ./ May 13 18:12:44 myhost.com smbd_audit[13474]: opendir . May 13 18:12:50 myhost.com smbd_audit[13474]: opendir . May 13 18:12:50 myhost.com smbd_audit[13474]:

HI all, So I'd like to log the user's operations on some shares. As I need to know who made what when. I'd read a previous answer from Andrew about auditing, so I can see loggued operations. Modified smb.conf : > [global] > vfs objects = dfs_samba4, acl_xattr, full_audit > full_audit:success =none > full_audit:failure = none share is : > [journal] > path =

I just got an INTERNAL ERROR: Signal 11 in smbd (4.12.10) in something that sids_to_unixids() in source3/winbindd/idmap_hash/idmap_has.c calls and 3 levels down - unfortunately the stack trace doesn?t say what it is - probably optimised into inline code or something. Recently upgraded from Samba 4.12.5 to 4.12.10 (self-compiled). FreeBSD 12.2 It happened right after 10 hours since that smbd

Hi all, Our users have started to complain that some of the time they're unable to save Word documents to our Samba drive - Word tells them the disk is full. I had a look at the logs, and there are a lot of weird "Function not implemented" errors. These have been there for a while, but the "Operation not permitted" ones seem new. Nothing on the server has changed.

Hi, I'm using full_audit vfs module and I'm seeing a lot of duplicated messages in log file. Why does it happens ? How can I configure de smb.conf not to log duplicated information ? Duplicated log: Jan 4 13:27:50 server smbd_audit: [2015/01/04 13:27:50|semirames|samba-admin|192.168.0.3|setores]|pread|ok|Atendimento/James.txt Jan 4 13:27:50 server smbd_audit: [2015/01/04

When VFS full_audit is activated the server doesn't allow users to write changes in any file. The log vfs:10 shows: Jan 12 22:22:00 loginserver smbd_audit: aaaa.bbbb|192.168.23.10|get_real_filename|fail (Operation not supported)|/Novo Documento de Texto.txt->(null) Jan 12 22:22:00 loginserver smbd_audit: aaaa.bbbb|192.168.23.10|fchmod_acl|fail (No data available)|Novo Documento de

Hello all, after the upgarde from Samba 4.10.7 to 4.11.2 we get lots of these in our logfiles: 2019-11-28T20:40:44+01:00 lx-sv-09 smbd_audit: [2019/11/28 20:40:44.886615, 1] ../../source3/locking/share_mode_lock.c:597(get_share_mode_lock) 2019-11-28T20:40:44+01:00 lx-sv-09 smbd_audit: get_share_mode_lock: get_static_share_mode_data failed: NT_STATUS_NO_MEMORY There are no symptoms accept

Hi all, I just upgraded from Samba 3.0 to 3.2 and found that the old smbd_audit module no longer works. This module logs all file accesses (especially deletes and renames) into a MySQL database (with a web frontend) and is extremely useful for us as sometimes our users accidentally move things around when they're trying to double-click on folder, and by reviewing the audit trail we can track

Am 06.12.2017 um 10:14 schrieb Rowland Penny via samba: > On Tue, 5 Dec 2017 15:39:25 -0700 (MST) > Mariusz80 via samba <samba at lists.samba.org> wrote: > >> Well permisions are working fine but, if i create for example "new >> folder" then the owner is root and what about the main problem with >> mmc. >> > > New files/directories will be

Colleagues, I come to seek help to solve this problem. I use Samba 4.4.5. I'm getting errors when running gpupdate / force on local desktops. I get the following error: User policy could not be updated successfully. The following errors were encountered: The processing of Group Policy failed. Windows could not apply the registry-based policy settings for the Group Policy object

Forgot to mention that this is on Centos 8. So maybe something different than this: https://www.spinics.net/lists/samba/msg163085.html Regards Christian Am 16.04.20 um 13:45 schrieb Christian Naumer via samba: > Hello alAl, > after update of our test server to 4.12.1 from 4.11 it crashes. If the > vfs module is removed from the config everthing works as before. Logs > from the

Hello. Today a box I manage throwed a lot of these (Samba 4.3.3 working as an ADS member on FreeBSD 10.1/amd64): > Mar 7 15:18:54 xxxxxx smbd_audit[51710]: connect to service xxxxxxxxx by user XXXXXXXX\xxxxxxxx > Mar 7 15:18:54 xxxxxx smbd_audit[51710]: open XXXXXXXXX/XXXXXXXXX.ods (fd 9) > Mar 7 15:18:54 xxxxxx smbd_audit[51710]: [2016/03/07 15:18:54.364808, 0]

I have share with a lot of scan files with .tif extension. They are grouped in catalogs by years for example 2006 2007 2008 etc. I would like to log open files (open scanned files .tif) by users. But /var/log/messages shows a lot of useless informations!!. For example user fujitsu opened only file 11005_07.tif in windows explorer. In /var/log/messages I can't exactly know which file was

(resend 3 !) Am 27.11.19 um 14:28 schrieb L.P.H. van Belle via samba: > Hai, > > DM, right.. > > (short version) > Just install/setup a the new DM. Add it to the domain. > Transfer all data and correct rights where needed. can't: data is on SAN ... will get "plugged in" via FibreChannel tmrw > Test it, all ok, poweroff the old server, > Remove the