{"id":2505,"date":"2015-05-07T08:15:36","date_gmt":"2015-05-07T07:15:36","guid":{"rendered":"http:\/\/kudzia.eu\/b\/?p=2505"},"modified":"2015-05-07T08:15:36","modified_gmt":"2015-05-07T07:15:36","slug":"auditaccess-logs-in-samba","status":"publish","type":"post","link":"https:\/\/kudzia.eu\/b\/2015\/05\/auditaccess-logs-in-samba\/","title":{"rendered":"audit\/access logs in samba"},"content":{"rendered":"<p>i&#8217;ve &#8216;convinced&#8217; my samba running under debian wheezy\/jessie to provide me access audit logs without being too verbose. here&#8217;s how.<\/p>\n<p><!--more--><\/p>\n<p>in \/etc\/rsyslog.d\/50-smbd_audit.conf i have to tell rsyslogd to direct audit logs to a separate file:<\/p>\n<pre class=\"brush: plain; title: ; notranslate\" title=\"\">\r\nif $programname == 'smbd_audit' then \/var\/log\/samba\/audit.log\r\nif $programname == 'smbd_audit' then ~\r\n<\/pre>\n<p>in \/etc\/samba\/smb.conf i tell samba to generate such information:<\/p>\n<pre class=\"brush: plain; title: ; notranslate\" title=\"\">\r\nvfs object = full_audit\r\nfull_audit:prefix = %S|%u|%I|%m\r\nfull_audit:success = chdir mkdir open opendir read rename rmdir write link unlink\r\nfull_audit:failure = none\r\nfull_audit:facility = local7\r\nfull_audit:priority = notice\r\n<\/pre>\n<p>and finally tell logrotate to archive the files daily &#8211; \/etc\/logrotate.d\/smbd_audit<\/p>\n<pre class=\"brush: plain; title: ; notranslate\" title=\"\">\r\n\/var\/log\/samba\/audit.log\r\n{\r\nrotate 7\r\ndaily\r\nmissingok\r\nnotifempty\r\ndelaycompress\r\ncompress\r\npostrotate\r\n invoke-rc.d rsyslog rotate &gt; \/dev\/null\r\nendscript\r\n}\r\n<\/pre>\n<p>finally restart both samba and rsyslog and enjoy the logs:<\/p>\n<pre class=\"brush: plain; title: ; notranslate\" title=\"\">\r\nservice smbd restart\r\nservice rsyslogd restart\r\ntail -f \/var\/log\/samba\/audit.log\r\n<\/pre>\n","protected":false},"excerpt":{"rendered":"<p>i&#8217;ve &#8216;convinced&#8217; my samba running under debian wheezy\/jessie to provide me access audit logs without being too verbose. here&#8217;s how.<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[17],"tags":[90],"class_list":["post-2505","post","type-post","status-publish","format-standard","hentry","category-tech","tag-samba"],"_links":{"self":[{"href":"https:\/\/kudzia.eu\/b\/wp-json\/wp\/v2\/posts\/2505","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/kudzia.eu\/b\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/kudzia.eu\/b\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/kudzia.eu\/b\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/kudzia.eu\/b\/wp-json\/wp\/v2\/comments?post=2505"}],"version-history":[{"count":1,"href":"https:\/\/kudzia.eu\/b\/wp-json\/wp\/v2\/posts\/2505\/revisions"}],"predecessor-version":[{"id":2506,"href":"https:\/\/kudzia.eu\/b\/wp-json\/wp\/v2\/posts\/2505\/revisions\/2506"}],"wp:attachment":[{"href":"https:\/\/kudzia.eu\/b\/wp-json\/wp\/v2\/media?parent=2505"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/kudzia.eu\/b\/wp-json\/wp\/v2\/categories?post=2505"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/kudzia.eu\/b\/wp-json\/wp\/v2\/tags?post=2505"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}