That is great! And only leaves one problem: The only way we know easily who did what and where is by putting the logs in a log file like "%U.%m.log" . Is there yet another way to accomplish this because syslog doesn't have those variables? The ultimate goal is to parse and put in a database for statistics and finding out who messed up.
Biggest question yet: Is there somewhere I could have read to find the solution you suggested above with the facilities/priority etc.. I hate to ask questions like this if there is somewhere I can read and learn from myself. I have searched the Internet tirelessly and have not run across the solution you suggested. How can I find such solutions...?! Thank you for your time and help!, Ryan On 2/7/06, Deryck Hodge <[EMAIL PROTECTED]> wrote: > On 2/2/06, Ryan Taylor <[EMAIL PROTECTED]> wrote: > > Not only is it harder to parse but it doesn't show > > open/close/edit/etc.. of files and seems completely different than > > 'audit'. > > > > I am just wondering if there is a way to get 'audit' results into the > > logfile other than syslog. > > > > With any of the audit modules, you can direct the entries being sent > to syslog to an external file. > > In smb.conf, something like the following > > vfs objects = full_audit > full_audit:facility = LOCAL5 > full_audit:priority = NOTICE > > will allow you to do this in /etc/syslog.conf: > > local5.notice /path/to/another/log > > Restart or reload syslogd and away you go. > > Cheers, > deryck > > -- > Deryck Hodge > http://www.devurandom.org/ > http://www.samba.org/ > > "Aimless days, uncool ways of decathecting" --Mike Doughty (2005) > -- Ryan Taylor Micro Consultants 770-789-2072 [EMAIL PROTECTED] "If I had to live my life again, I'd make the same mistakes, only sooner." Tallulah Bankhead -- To unsubscribe from this list go to the following URL and read the instructions: https://lists.samba.org/mailman/listinfo/samba
