pwrite problem in samba log

jogyulas · 05-22-2014, 06:07 AM

Hello,

I have a samba share on my server.
I wanted to check users' activities on it so I set 'vfs objects = full_audit' in smb.conf.
It works and logs fine, but there is an annoying problem.
Checking the log file I realised when I upload a file the pwrite paramter appears many times in the log. Practically this event floods my log file.

For example:
May 22 12:24:30 xxx pwrite|ok|qwe/CPU-Z-1.69.zip
May 22 12:24:30 xxx pwrite|ok|qwe/CPU-Z-1.69.zip
May 22 12:24:30 xxx pwrite|ok|qwe/CPU-Z-1.69.zip

And so on approximatelly 50 times until the copy is working : )
Other paramters is working well.

What would cause this problem? Are there any who has encountered similar problem?

Many thanks

dijetlo · 05-23-2014, 11:11 AM

Quote:

May 22 12:24:30 xxx pwrite|ok|qwe/CPU-Z-1.69.zip

It looks like it's just writing to the disk, it does that a lot....
Turn down your logging level to something sane, like 2 or 3 and routine calls will probably go away.

jogyulas · 05-26-2014, 04:02 AM

thank you for your response
Honestly, I do not know where I should modify level.
I think here:
full_audit:priority = notice
I have tried to set other value instead of notice but unfortunately it did not have any effect my problem.

pan64 · 05-26-2014, 04:17 AM

you need to restart samba (or force to reload config), modifying (editing the config file) is not enough.

jogyulas · 05-26-2014, 04:21 AM

of course I restarted smb, but it does not work well :- /

dijetlo · 05-26-2014, 04:42 AM

Hi jogyulas

Quote:

of course I restarted smb,

Pan is helping you Jog, if I hadn't caught this line in your initial post...

Quote:

It works and logs fine, but there is an annoying problem.

I'd have told you the same thing.
From our friends at Samba

Code:

[global]
    workgroup = METRAN
    encrypt passwords = yes
    wins support = yes
    log level = 1 
    max log size = 1000
    read only = no
[homes] 
    browsable = no
    map archive = yes
[printers] 
    path = /var/tmp
    printable = yes
    min print space = 2000
[test]
    browsable = yes
    read only = yes
    path = /usr/local/samba/tmp

jogyulas · 05-26-2014, 04:58 AM

my conf:

Code:

[qwe]
path = /qwe
guest ok = no
writeable = yes
create mask = 000
force create mode = 0664
directory mask = 000
force directory mode = 2775
browseable = no
vfs objects = full_audit
full_audit:prefix = %u|%I|%m|%S
full_audit:success = mkdir rmdir rename unlink pwrite
full_audit:failure = none
full_audit:facility = local7
full_audit:priority = notice

I think I should not set any log level because 'syslog only = no' in my conf.
But I have a question:
When I copy a file to my share it is equal upload.
Therefore upload has "tcp slice", so what I see in my log is it a lots of successful "tcp slice"? Probably is it the good, normal behaviour of log?

pan64 · 05-26-2014, 05:02 AM

probably it is logged by something else?

dijetlo · 05-26-2014, 05:22 AM

Explicitly state the log level in the global section of your smb.conf. Reload the config.
Let's make sure the instructions don't work before we redesign the thing.

dijetlo · 05-26-2014, 05:24 AM

@pan64

Quote:

probably it is logged by something else?

I thought about that but what could be logging samba disk writes but samba?
System maybe?

jogyulas · 05-26-2014, 05:33 AM

dijetlo: I have tried global log level with various values, but the problem was same.

Quote:

probably it is logged by something else?

I do not know, but I will check it somehow as soon as I can

I welcome every good idea about it : )