Logging samba share in Ubuntu 12.04 LTS


 
Thread Tools Search this Thread
Operating Systems Linux Ubuntu Logging samba share in Ubuntu 12.04 LTS
# 1  
Old 09-23-2013
[SOLVED]Logging samba share in Ubuntu 12.04 LTS

Hi guys

I am trying to log full_audit on my samba shares so I know who is creating, deleting, renaming, moving etc. files and directories in the samba/windows share.

In my
Code:
etc/samba/smb.conf

file, under [global] I have:


Code:
# Audit settings
full_audit: prefix = %u|%I|%S
full_audit:failure = connect
full_audit:success = connect disconnect opendir mkdir rmdir closedir open close read pread write pwrite sendfile rename unlink chmodfchmod chown fchown chdir ftruncate lock symlink readlink link mknod realpath
full_audit:facility = local5
full_audit: priority = notice

And under my [file share name] I have:
Code:
vfs object = full_audit

I created a new file in
Code:
etc/rsyslog.d

called
Code:
00-samba-audit.conf

with these two lines in:
Code:
local5.notice /var/log/samba/audit.log
&~

And in the file
Code:
 /etc/rsyslog.d/50-default.conf

I changed the following line:
Code:
*.*;auth,authpriv.none -/var/log/syslog

to read:
Code:
*.*;local5,auth,authpriv.none -/var/log/syslog

with this below it:
Code:
local5.notice /var/log/samba/audit.log

I then restarted samba and rsyslog. (This all comes from this web page: http://a32.me/2009/10/samba-audit-trail/ ) It creates the audit.log file in my /var/log/samba/ directory but nothing else happens; it remains empty.
What am I doing wrong?!
I would be really great if someone could help me to audit my windows/samba share so I know who is creating, moving, deleting, renaming files etc.


Thanks!

------------edit---------------------

Moderator please close this thread, it's solved long back, it was permission issue, and sorry today I am informing.

Last edited by Akshay Hegde; 11-30-2013 at 12:07 PM.. Reason: to inform moderator to close thread
Login or Register to Ask a Question

Previous Thread | Next Thread

6 More Discussions You Might Find Interesting

1. UNIX for Beginners Questions & Answers

Copy files to samba share Ubuntu 14.04

I am trying to use mv or cp rsync to copy folders to a samba share. I can manually copy the folders to the share, but can not seem to access it using command line. Thank you :). smbclient //path/to/cifs/share <password> -W <domain> -u <user> WARNING: The "syslog" option is deprecated... (2 Replies)
Discussion started by: cmccabe
2 Replies

2. Ubuntu

Emacs printing with Ubuntu 14.04 LTS

I am trying to setup a development environment that mirrors my Windows and SCO Unix systems. I use emacs and I am having trouble printing. I keep getting the error message; Symbol's function definition is void: default-printer-name I have googled this and for possible answers for... (0 Replies)
Discussion started by: trolley
0 Replies

3. UNIX for Dummies Questions & Answers

Ubuntu Server 14.04 LTS - domain controller configuration (SAMBA)

Hello! Never configured a Linux server from a scratch. Reviewed the official documentation and dozens of different "how to", but now one of them helped me to solve the issue. The need: My final goal is to install a small network (later with around 10 stations) where I can controle the... (0 Replies)
Discussion started by: AQwert
0 Replies

4. Proxy Server

Unable to access Samba share with Ubuntu on Win7

I have an issue with my Samba share - I am unable to write to it, edit a file or rename a folder etc within Windows. I am using Windows 7 and Ubuntu 12.04 and this is my Samba config. I can connect to the /sylius directory no problem (no password required), but I cannot save to it. Is... (3 Replies)
Discussion started by: crmpicco
3 Replies

5. Solaris

samba issue: one samba share without password prompting and the others with.

Hi All, I've been trying to configure samba on Solaris 10 to allow me to have one share that is open and writable to all users and have the rest of my shares password protected by a generic account. If I set my security to user, my secured shares work just fine and prompt accordingly, but when... (0 Replies)
Discussion started by: ideal2545
0 Replies

6. Solaris

Ubuntu 10.04 LTS vs Solaris 10

Hello, I am considering Ubuntu 10.04 (ubuntu-10.04.3-desktop-amd64.iso) and also Solaris 10 (sol-10-u10-ga2-x86-dvd.iso) for different hardware applications and I had a few questions. The hardware on my laptop is: HP Pavilion dv4 2045-dx x64 laptop AMD Turion(tm) II Dual-Core Mobile M500... (4 Replies)
Discussion started by: Marcus Aurelius
4 Replies
Login or Register to Ask a Question