Samba Log all user activities

simplyA · 05-29-2007, 06:21 AM

Hi,

can anyone tell me how I can log all my samba users delete and write activities? Currently I have set following config options:

admin log = yes
log level = 2
syslog = 2
log file = /var/opt/samba/log.%m

I do get following messages in my log file when I create and delete a file:

Quote:

linux-me (10.2.10.17) connect to service win_pub as user win_pub (uid=116, gid=20) (pid 10317)
[2007/05/29 14:37:52, 2] smbd/open.c:(243)
public opened file file.txt read=No write=Yes (numopen=1)
[2007/05/29 14:37:52, 2] smbd/close.c:(227)
win_pub closed file file.txt (numopen=0)
[2007/05/29 14:39:29, 2] smbd/open.c:(243)
public opened file file.txt read=Yes write=No (numopen=1)
[2007/05/29 14:39:29, 2] smbd/close.c:(227)
win_pub closed file file.txt (numopen=0)

Unfortunately, i can't figure out what a file is beeing read, created, deleted or just modified. Does anyone have a better solution?

Thanks in advance,

simplyA

marozsas · 05-29-2007, 07:38 AM

Samba has a audit module which can provide full logging on shares.
In the log file you will get something like that:

Code:

May 29 09:31:59 smbsrv smbd_audit: johndoe|192.168.xx.yy|machine-name|Share-name|open|ok|r|dir1/dir2/file

besides the open mode, you can get pwrite,unlink,rename,rmdir,mkdir, etc...check the documentation.

All you need is the full_audit module (/usr/lib/samba/vfs/full_audit.so) which is part of samba server (mine is samba-3.0.24-6.ccj1.rpm) and add the following in your share definition:

Code:

        vfs objects = full_audit
        full_audit:failure = none
        full_audit:success = mkdir rename unlink rmdir open pwrite
        full_audit:prefix = %u|%I|%m|%S

simplyA · 08-18-2007, 06:35 AM

Thanks and sorry for the late reply!

sato · 09-05-2007, 08:46 PM

First, thank you for those invaluable information. From reading somewhere, following the action was the result -- in this case 'ok' followed the open action. Then what the 'r' (the 'r' between open and file name)represents for?

Other thing I would like to ask. When people open a shared directory, especially when there were a lot of sub directory within, lots of information concerning the |stat|fail were thrown into the /etc/log/messages. Can we prevent this to show up there, since I only need the rmdir, mkdir, unlink and rename logs and it makes my log messages grow up to big (60MB of file size within 4-6 hours)? Thank you in advance for your help.

PS. Pardon my english.

Regards,

sato

Quote:

Originally Posted by marozsas

Samba has a audit module which can provide full logging on shares.
In the log file you will get something like that:

Code:

May 29 09:31:59 smbsrv smbd_audit: johndoe|192.168.xx.yy|machine-name|Share-name|open|ok|r|dir1/dir2/file

marozsas · 09-06-2007, 07:51 AM

Quote:

Originally Posted by sato

Then what the 'r' (the 'r' between open and file name)represents for?

Is the open mode, in this case, opened for reading. But you can get "|w|" which stands for open for writing.

Quote:

Originally Posted by sato

Can we prevent this to show up there, since I only need the rmdir, mkdir, unlink and rename logs and it makes my log messages grow up to big (60MB of file size within 4-6 hours)?

I have no idea. Sorry....If you managed to figure out, please post the solution back in this thread.

magnetux · 07-07-2008, 04:11 AM

how can i get report for full_audit.so module like this

29 09:31:59 smbsrv smbd_audit: johndoe|192.168.xx.yy|machine-name|Share-name|open|ok|r|dir1/dir2/file

this is my smb.conf

[global]
workgroup = MYSERVER
netbios name = slackware12
server string = Samba Server
log level = 2
log file = /var/log/samba.%m
max log size = 50
level2 oplocks = True
#
[audit]
comment = audit
path = /mnt/hda3/tes
create mask = 0777
directory mask = 0777
vfs objects = full_audit
full_audit:failure = none
full_audit:success = mkdir rename unlink rmdir open pwrite
full_audit:prefix = %u|%I|%m|%S
writeable = yes
browseable = yes
security = user
valid users = samba

and this is my report

----------------cut--------------------------------

[2008/07/07 16:15:03, 2] smbd/close.c:close_normal_file(399)
samba closed file 06. KAU YANG TERINDAH.mp3 (numopen=0) NT_STATUS_OK
[2008/07/07 16:15:03, 2] smbd/open.c:open_file(391)
samba opened file 07. ALLAH BAPA.mp3 read=No write=Yes (numopen=1)
[2008/07/07 16:15:03, 2] smbd/close.c:close_normal_file(399)
samba closed file 07. ALLAH BAPA.mp3 (numopen=0) NT_STATUS_OK
[2008/07/07 16:15:03, 2] smbd/open.c:open_file(391)
samba opened file 08. YESUS SAHABATKU.mp3 read=No write=Yes (numopen=1)
[2008/07/07 16:15:03, 2] smbd/close.c:close_normal_file(399)
samba closed file 08. YESUS SAHABATKU.mp3 (numopen=0) NT_STATUS_OK
[2008/07/07 16:15:03, 2] smbd/open.c:open_file(391)
samba opened file 09. BAPAKU RINDU.mp3 read=No write=Yes (numopen=1)
[2008/07/07 16:15:03, 2] smbd/close.c:close_normal_file(399)
samba closed file 09. BAPAKU RINDU.mp3 (numopen=0) NT_STATUS_OK
[2008/07/07 16:15:03, 2] smbd/open.c:open_file(391)
samba opened file 10. DENGAN SEGENAP HATI.mp3 read=No write=Yes (numopen=1)
[2008/07/07 16:15:03, 2] smbd/close.c:close_normal_file(399)
samba closed file 10. DENGAN SEGENAP HATI.mp3 (numopen=0) NT_STATUS_OK

---------------------cut----------------------------------------------

Avdaga · 02-04-2011, 04:02 AM

The full_audit is written to syslog.
Check http://moiristo.wordpress.com/2009/0...user-activity/

Add to samba config:

Code:

vfs objects = full_audit

full_audit:prefix = %u|%I|%m|%S
full_audit:success = mkdir rename unlink rmdir pwrite
full_audit:failure = none
full_audit:facility = LOCAL7
full_audit:priority = NOTICE

If you are using rsyslog (debian squeeze uses it), then add to /etc/rsyslog.conf:

Code:

if $syslogfacility-text == 'local7' and $programname == 'smbd' then /var/log/samba/log.audit

Don't forget to restart rsyslogd. In debian squeeze:

Code:

/etc/init.d/rsyslog restart