When I use 'vfs objects = audit' then I get nice messages in the syslog like:
Feb 1 17:17:57 tethys smbd_audit[19432]: opendir Workspace Feb 1 17:17:58 tethys smbd_audit[19432]: open Workspace/test.txt (fd 27) Feb 1 17:18:00 tethys smbd_audit[19432]: close fd 27 Feb 1 17:17:58 tethys smbd_audit[19432]: open Workspace/test.txt (fd 27) for writing Feb 1 17:17:58 tethys smbd_audit[19432]: opendir Workspace Feb 1 17:17:58 tethys smbd_audit[19432]: open Workspace/test.txt (fd 28) Feb 1 17:17:58 tethys smbd_audit[19432]: close fd 28 Feb 1 17:17:58 tethys smbd_audit[19432]: close fd 27 Feb 1 17:18:02 tethys smbd_audit[19432]: disconnected ######################################### But with 'audit' it only outputs to the syslog; If I use 'extd_audit' then it outputs to both syslog and the logfile I specified ( %U.%m.log ) However not the same... like: [2006/02/01 17:12:46, 1] modules/vfs_extd_audit.c:audit_opendir(164) vfs_extd_audit: opendir Workspace [2006/02/01 17:16:05, 10] modules/vfs_extd_audit.c:init_module(362) vfs_extd_audit: Debug class number of 'extd_audit': 18 [2006/02/01 17:16:07, 10] modules/vfs_extd_audit.c:audit_connect(135) Connected to service proj as user mance [2006/02/01 17:16:07, 10] modules/vfs_extd_audit.c:audit_disconnect(145) Disconnected from VFS module extd_audit [2006/02/01 17:16:07, 10] modules/vfs_extd_audit.c:audit_connect(135) Connected to service proj as user mance [2006/02/01 17:16:05, 10] modules/vfs_extd_audit.c:audit_disconnect(145) Disconnected from VFS module extd_audit ###################################################### Not only is it harder to parse but it doesn't show open/close/edit/etc.. of files and seems completely different than 'audit'. I am just wondering if there is a way to get 'audit' results into the logfile other than syslog. Thank you for any advise and please let me know if I can include any more examples or information! On 2/1/06, Jeremy Allison <[EMAIL PROTECTED]> wrote: > On Wed, Feb 01, 2006 at 03:45:50PM -0500, Ryan Taylor wrote: > > I would like to turn on auditing for a particular share and have all > > auditing go to the username.machinename.log files. If I turn on audit > > then no matter which way I configure it, it either goes to just syslog, > > or both. My goal is to just log to the samba files and take the wieght > > off of syslog. I have searched and searched but can't find but a > > solution that works. Any help would be greatly > > appreciated. > > > > I have it set now as: > > ... > > log level = 0 vfs:2 > > syslog = 0 > > ... > > What vfs audit module are you using ? As far as I know the > all go to syslog. > > Jeremy. > -- Ryan Taylor Micro Consultants 770-789-2072 [EMAIL PROTECTED] "If I had to live my life again, I'd make the same mistakes, only sooner." Tallulah Bankhead -- To unsubscribe from this list go to the following URL and read the instructions: https://lists.samba.org/mailman/listinfo/samba