On Sun, May 14, 2006 at 02:40:15PM +0530, Honey Bajaj wrote: > I can customize Sa-Samba module to log only the details about user/system > from where the files are getting deleted or moved, where as full-audit > module is pretty bulky and it logs lots of things and on the first instance > it didn't give the output as it is given by Sa-samba. My requirement is I > only want to log details to syslog when any file/folder is deleted or > unlink. Please advise
Further down find the comment on top of vfs_full_audit.c. So you would use vfs objects = full_audit full_audit:prefix = %u|%I full_audit:success = unlink full_audit:failure = unlink Hope that helps, Volker /* * This module implements parseable logging for all Samba * VFS operations. * * You use it as follows: * * [tmp] * path = /tmp * vfs objects = full_audit * full_audit:prefix = %u|%I * full_audit:success = open opendir * full_audit:failure = all * * vfs op can be "all" which means log all operations. * vfs op can be "none" which means no logging. * * This leads to syslog entries of the form: * smbd_audit: nobody|192.168.234.1|opendir|ok|. * smbd_audit: nobody|192.168.234.1|open|fail (File not found)|r|x.txt * * where "nobody" is the connected username and * "192.168.234.1" is the * client's IP address. * * Options: * * prefix: A macro expansion template prepended to the * syslog entry. * * success: A list of VFS operations for which a successful * completion should * be logged. Defaults to no logging at all. The special * operation "all" logs * - you guessed it - everything. * * failure: A list of VFS operations for which failure to * complete should be * logged. Defaults to logging everything. */
pgpA0Ww14fpiQ.pgp
Description: PGP signature
-- To unsubscribe from this list go to the following URL and read the instructions: https://lists.samba.org/mailman/listinfo/samba
