vfs_full_audit

Name

vfs_full_audit — record Samba VFS operations in the system log

Synopsis

vfs objects = full_audit

DESCRIPTION

This VFS module is part of the + samba(7) suite.

The vfs_full_audit VFS module records selected + client operations to the system log using + syslog(3).

vfs_full_audit is able to record the + complete set of Samba VFS operations:

aio_cancel

aio_error

aio_fsync

aio_read

aio_return

aio_suspend

aio_write

chdir

chflags

chmod

chmod_acl

chown

closedir

connect

disconnect

disk_free

fchmod

fchmod_acl

fchown

fget_nt_acl

fgetxattr

flistxattr

fremovexattr

fset_nt_acl

fsetxattr

fstat

fsync

ftruncate

get_nt_acl

get_quota

get_shadow_copy_data

getlock

getwd

getxattr

kernel_flock

lgetxattr

link

linux_setlease

listxattr

llistxattr

lock

lremovexattr

lseek

lsetxattr

lstat

mkdir

mknod

open

opendir

pread

pwrite

read

readdir

readlink

realpath

removexattr

rename

rewinddir

rmdir

seekdir

sendfile

set_nt_acl

set_quota

setxattr

stat

statvfs

symlink

sys_acl_add_perm

sys_acl_clear_perms

sys_acl_create_entry

sys_acl_delete_def_file

sys_acl_free_acl

sys_acl_free_qualifier

sys_acl_free_text

sys_acl_get_entry

sys_acl_get_fd

sys_acl_get_file

sys_acl_get_perm

sys_acl_get_permset

sys_acl_get_qualifier

sys_acl_get_tag_type

sys_acl_init

sys_acl_set_fd

sys_acl_set_file

sys_acl_set_permset

sys_acl_set_qualifier

sys_acl_set_tag_type

sys_acl_to_text

sys_acl_valid

telldir

unlink

utime

write

In addition to these operations, + vfs_full_audit recognizes the special operation + names "all" and "none ", which refer to all + the VFS operations and none of the VFS operations respectively. +

vfs_full_audit records operations in fixed + format consisting of fields separated by '|' characters. The + format is:

+		smbd_audit: PREFIX|OPERATION|RESULT|FILE
+

The record fields are:

PREFIX - the result of the full_audit:prefix string after variable substitutions
OPERATION - the name of the VFS operation
RESULT - whether the operation succeeded or failed
FILE - the name of the file or directory the operation was performed on

This module is stackable.

OPTIONS

vfs_full_audit:prefix = STRING: Prepend audit messages with STRING. STRING is + processed for standard substitution variables listed in + smb.conf(5). The default + prefix is "%u|%I".
vfs_full_audit:success = LIST: LIST is a list of VFS operations that should be + recorded if they succeed. Operations are specified using + the names listed above. +
vfs_full_audit:failure = LIST: LIST is a list of VFS operations that should be + recorded if they failed. Operations are specified using + the names listed above. +
full_audit:facility = FACILITY: Log messages to the named + syslog(3) facility. + +
full_audit:priority = PRIORITY: Log messages with the named + syslog(3) priority. +

EXAMPLES

Log file and directory open operations on the [records] + share using the LOCAL7 facility and ALERT priority, including + the username and IP address:

+        [records]
+	path = /data/records
+	vfs objects = full_audit
+	full_audit:prefix = %u|%I
+	full_audit:success = open opendir
+	full_audit:failure = all
+	full_audit:facility = LOCAL7
+	full_audit:priority = ALERT
+

VERSION

This man page is correct for version 3.0.25 of the Samba suite. +

AUTHOR

The original Samba software and related utilities + were created by Andrew Tridgell. Samba is now developed + by the Samba Team as an Open Source project similar + to the way the Linux kernel is developed.