Samba log

Ok I found some page about this. I did this:

  1. added to usr/local/etc/smb.conf under [global]

    Code: 
        vfs objects = full_audit
    full_audit:prefix = %u|%I|%m|%S
    full_audit:success = mkdir rename unlink rmdir pwrite pread connect disconnect
    full_audit:failure = none
    full_audit:facility = LOCAL7
    full_audit:priority = NOTICE
  2. Added a line to etc/syslog.conf

    Code: 
    local7.* /var/log/samba/audit/log.audit
  3. I created the folder audit in /var/log/samba
  4. Restarted syslogd and Samba.

After all this, I went to a computer that has Windows XP and tested it but sadly it does not log a thing. Any ideas? Thanks again.
 
Abriel said:
I have in /usr/local/etc/smb.conf
Code: 
[global]
log level = 2
log file = /var/log/samba/log.%m
Click to expand...

But what you can see with this? Do you have records if someone copy, rename or delete something?
 
You must log in or register to reply here.
Back
Top