how can find the login IP?

alice95089 · 02-27-2005, 09:29 PM

Hi all,

I would like to ask:
There are samba server in my working company and our team can login the server using a share account..

I would like to ask, how can i find the login IP and what they did ?What i mean is that,,sometimes there files added and files deleted in the samba, i would like to find the IP who did that...

Thanks
Alice

Matir · 02-27-2005, 09:59 PM

Crank the logging level up (I'm not sure how high you'll need to get the information you want, the samba man pages have more on this) and then the log files will have all the relevant information.

alice95089 · 02-28-2005, 02:59 AM

Hi Matir,
I have the root account and would you please tell me more what do you mean by crack the log file?

Thanks
Alice

Matir · 02-28-2005, 11:34 AM

I mean, set the log level directive in samba.conf.

log level = 3 is likely to provide you with all the information you need.

linuxdream · 02-28-2005, 01:40 PM

The info should be in the samba log file in /var/log/samba and each IP address should have their own log file. That's the default setup for FC3 but you might need enable that type of logging like Matir said.

alice95089 · 03-01-2005, 12:19 AM

Hi linuxdream,
As i am just a newbie for linux..would you mind telling me more how to set the level?
Furthermore, i would like to ask....how can i use the man page for samba? man samba?

Here are the log:

[root@localhost samba]# pwd
/var/log/samba
[root@localhost samba]#

[root@localhost samba]# cat alice.log.1
[2005/02/22 09:42:41, 0] passdb/pdb_smbpasswd.c

db_getsampwnam(1369)
unable to open passdb database.
[2005/02/22 09:43:06, 0] passdb/pdb_smbpasswd.c

db_getsampwnam(1369)
unable to open passdb database.
[2005/02/22 09:43:06, 0] tdb/tdbutil.c:tdb_log(531)
tdb(/var/cache/samba/locking.tdb): expand_file write of 1024 failed (Operation not permitted)
[2005/02/22 09:43:06, 0] smbd/trans2.c:set_delete_on_close_internal(2208)
set_delete_on_close_internal: failed to change delet

I don't know what you mean by setting up the log level config file....

Thanks

Matir · 03-01-2005, 08:30 AM

Somewhere in your system there is the file that contains the SAMBA configuration. Usually /etc/samba.conf /etc/samba/smb.conf or /etc/samba/samba.conf. In the [global] section of that file, add or change a "log level" line to "log level = your desired level". The levels, IIRC, go from 0-10, with 10 being so much it would generate HUGE logs in no time: 10 is for software debugging, essentially.

trickykid · 03-01-2005, 08:34 AM

The lines your looking for in your smb.conf file should look along the lines like this:

Code:

log file = /var/log/samba/%m.log
log level = 1
max log size = 500  # keep last 500k of log files (recommended to keep logs from growing tremendously)