Hi,
I'm currently running Samba 3.0.22 (on an Ubuntu 6.06 [Dapper] server).
I have VFS full_audit set up successfully to log user activity using the
LOCAL6 facility.
I also have syslog configured to redirect all messages from this
facility to /var/log/samba/log.audit
This is working fine. However, I've recently been getting lines in
/var/log/syslog that look like they're coming from full_audit. They all
look something like this:
Nov 29 10:12:07 SERVERNAME smbd[3312]:
root|xxx.xxx.xxx.xxx|<machineName>|<shareName>|realpath|ok|<sharePath>
Nov 29 10:12:07 SERVERNAME smbd[3312]:
<userName>|xxx.xxx.xxx.xxx|<machineName>|<shareName>|realpath|ok|<sharePath>
I can't for the life of me work out why these are appearing in the
syslog. The same lines also appear in samba/log.audit along with all the
other activity logs.
My smb.conf has this configured:
full_audit:prefix = %u|%I|%m|%S
full_audit:success = mkdir rename unlink rmdir pwrite
full_audit:failure = none
full_audit:facility = LOCAL6
full_audit:priority = NOTICE
...and I have the line "vfs objects = full_audit" added to each of my
share definitions.
Can anyone suggest how I can stop these lines appearing in syslog
please? - They're clogging up my logs and making it difficult to debug
other processes.
Thanks,
--
Luke
--
Luke
--
To unsubscribe from this list go to the following URL and read the
instructions: https://lists.samba.org/mailman/options/samba
