how to generate file and directory access logs?

dushyantgohil · 10-29-2012, 01:25 AM

hi,

in my cent os 5.5 server which is configured with samba server, users are accessing directories and files. i want to generate the logs of those accessed directories and files. which user has accessed file/directory at what time etc.

how to do that any one can help me out in this.

acid_kewpie · 10-29-2012, 03:19 AM

http://www.linuxquestions.org/questi...ux-smb-808012/

dushyantgohil · 10-29-2012, 04:34 AM

hi as per your given link i have done but it not shows me the log as per

Code:

May  7 13:05:26 bigslam smbd_audit: tatiane.falasca|192.168.160.24|stc-081|rh|unlink|ok|RECURSOS HUMANOS/volume03.doc
May  3 18:16:59 bigslam smbd_audit: erika|192.168.160.126|stc-057|at|open|ok|r|2010/Doctos scanneados/CTPS Paulo 3.JPG 
May  3 18:16:59 bigslam smbd_audit: erika|192.168.160.126|stc-057|at|pwrite|ok|2010/Doctos scanneados/B5a00196 
May  3 18:16:59 bigslam smbd_audit: erika|192.168.160.126|stc-057|at|rename|ok|2010/Doctos scanneados/Registro Paulo.zip|Lixeira/2010/Doctos scanneados/Copy #4 of Registro Paulo.zip

acid_kewpie · 10-29-2012, 04:40 AM

OK, so what have you found about any further configuration that may be required from this, now that you're aware of the samba audit system? does the config load OK? Have you tried changing the syslog pri / facility? Providing information here isn't a cue to stop looking things up for yourself.

dushyantgohil · 10-29-2012, 04:48 AM

this is what i have done in conf file.

Code:

[test]
	path = /var/www/html/test
;	browseable = yes
	writable = yes
	valid user = test
	vfs objects = full_audit
	full_audit:filure = none
	full_audit:success = mkdir rename unlink rmdir open pwrite
	full_audit:prefix = %u|%I|%m|%s

same as mentioned in the post

dushyantgohil · 10-29-2012, 04:50 AM

log is like

Code:

test-system-product-name (192.168.1.97) connect to service test initially as user test (uid=500, gid=501) (pid 11702)