Re: [Samba] tracking user actions
Eric, et al. We have been able to identify the user moving folders around, thanks to the help provided from the list. Thanks for the help folks, greg -- UNIX is user friendly, it's just selective about who its friends are. -- To unsubscribe from this list go to the following URL and read the instructions: http://lists.samba.org/mailman/listinfo/samba
RE: [Samba] tracking user actions
> > > > Nov 18 16:20:00 mercury smbd_audit[15738]: opendir . > > Nov 18 16:20:00 mercury smbd_audit[15738]: rename ./New > Folder -> ./two > > Nov 18 16:20:00 mercury smbd_audit[15738]: opendir ./ > > > > > > Perhaps I need a flag to turn on host name logging? I > > don't see this covered in the PDF. We do it by using %m or %M in the logfile name so each client logs to it's own log. That makes it easier to see exactly what a given client/user is doing or to turn up debugging for just one user. We also use ext_audit. --Eric -- To unsubscribe from this list go to the following URL and read the instructions: http://lists.samba.org/mailman/listinfo/samba
Re: [Samba] tracking user actions
On Tue, 18 Nov 2003, Greg Whynott wrote: > Adam Williams wrote: > > > Thanks Adam, > > The module actually does not work as I had expected. > > > Nov 18 16:20:00 mercury smbd_audit[15738]: opendir . > Nov 18 16:20:00 mercury smbd_audit[15738]: rename ./New Folder -> ./two > Nov 18 16:20:00 mercury smbd_audit[15738]: opendir ./ > > > Perhaps I need a flag to turn on host name logging? I don't see this > covered in the PDF. I think you might want the extd_audit module. It logs to the normal debug file. - John T. > > I could tail the log and grep the PID from the output of smbstatus upon > seeing a "rename", but this seems a bit clunky. > > thanks again, > greg > > > > > > Perhaps the Audit VFS modules as documented in the Samba HOWTO > > Collection PDF. > > -- John H Terpstra Email: [EMAIL PROTECTED] -- To unsubscribe from this list go to the following URL and read the instructions: http://lists.samba.org/mailman/listinfo/samba
Re: [Samba] tracking user actions
Adam Williams wrote: Thanks Adam, The module actually does not work as I had expected. Nov 18 16:20:00 mercury smbd_audit[15738]: opendir . Nov 18 16:20:00 mercury smbd_audit[15738]: rename ./New Folder -> ./two Nov 18 16:20:00 mercury smbd_audit[15738]: opendir ./ Perhaps I need a flag to turn on host name logging? I don't see this covered in the PDF. I could tail the log and grep the PID from the output of smbstatus upon seeing a "rename", but this seems a bit clunky. thanks again, greg > Perhaps the Audit VFS modules as documented in the Samba HOWTO > Collection PDF. -- UNIX is user friendly, it's just selective about who its friends are. -- To unsubscribe from this list go to the following URL and read the instructions: http://lists.samba.org/mailman/listinfo/samba
RE: [Samba] tracking user actions
Audit VFS does not log IP/username, only the actions. > > > We have either a disgruntle user or one who is inadvertently > > moving/deleting files. This has been going on for some > time now and > > I'd like to learn who it is so we may go speak with > her/him. How might > > we go about logging file/folder moves/deletes? Increasing the log > > level in smb.conf does not seem to provide the information we are > > after. Changing file perms/ownership/groups is not an > option in this > > case at this time. > > Perhaps the Audit VFS modules as documented in the Samba > HOWTO Collection PDF. > -- To unsubscribe from this list go to the following URL and read the instructions: http://lists.samba.org/mailman/listinfo/samba
Re: [Samba] tracking user actions
> We have either a disgruntle user or one who is inadvertently > moving/deleting files. This has been going on for some time now and I'd > like to learn who it is so we may go speak with her/him. > How might we go about logging file/folder moves/deletes? Increasing the > log level in smb.conf does not seem to provide the information we are > after. > Changing file perms/ownership/groups is not an option in this case at > this time. Perhaps the Audit VFS modules as documented in the Samba HOWTO Collection PDF. -- To unsubscribe from this list go to the following URL and read the instructions: http://lists.samba.org/mailman/listinfo/samba
[Samba] tracking user actions
Hello, We have either a disgruntle user or one who is inadvertently moving/deleting files. This has been going on for some time now and I'd like to learn who it is so we may go speak with her/him. How might we go about logging file/folder moves/deletes? Increasing the log level in smb.conf does not seem to provide the information we are after. Changing file perms/ownership/groups is not an option in this case at this time. Thanks for your time, greg -- To unsubscribe from this list go to the following URL and read the instructions: http://lists.samba.org/mailman/listinfo/samba
