VFS_FULL_AUDIT(8)

Name
vfs_full_audit - record Samba VFS operations in the system log

Synopsis

vfs objects = full_audit

DESCRIPTION

This VFS module is part of the samba(7) suite.

The vfs_full_audit VFS module records selected client operations to the system log using syslog(3).

vfs_full_audit is able to record the complete set of Samba VFS operations:
    aio_cancel
    aio_error
    aio_fsync
    aio_read
    aio_return
    aio_suspend
    aio_write
    chdir
    chflags
    chmod
    chmod_acl
    chown
    close
    closedir
    connect
    disconnect
    disk_free
    fchmod
    fchmod_acl
    fchown
    fget_nt_acl
    fgetxattr
    flistxattr
    fremovexattr
    fset_nt_acl
    fsetxattr
    fstat
    fsync
    ftruncate
    get_nt_acl
    get_quota
    get_shadow_copy_data
    getlock
    getwd
    getxattr
    kernel_flock
    lgetxattr
    link
    linux_setlease
    listxattr
    llistxattr
    lock
    lremovexattr
    lseek
    lsetxattr
    lstat
    mkdir
    mknod
    open
    opendir
    pread
    pwrite
    read
    readdir
    readlink
    realpath
    removexattr
    rename
    rewinddir
    rmdir
    seekdir
    sendfile
    set_nt_acl
    set_quota
    setxattr
    stat
    statvfs
    symlink
    sys_acl_add_perm
    sys_acl_clear_perms
    sys_acl_create_entry
    sys_acl_delete_def_file
    sys_acl_free_acl
    sys_acl_free_qualifier
    sys_acl_free_text
    sys_acl_get_entry
    sys_acl_get_fd
    sys_acl_get_file
    sys_acl_get_perm
    sys_acl_get_permset
    sys_acl_get_qualifier
    sys_acl_get_tag_type
    sys_acl_init
    sys_acl_set_fd
    sys_acl_set_file
    sys_acl_set_permset
    sys_acl_set_qualifier
    sys_acl_set_tag_type
    sys_acl_to_text
    sys_acl_valid
    telldir
    unlink
    utime
    write

In addition to these operations, vfs_full_audit recognizes the special operation names "all" and "none ", which refer to all the VFS operations and none of the VFS operations respectively.

vfs_full_audit records operations in fixed format consisting of fields separated by '|' characters. The format is:

    		smbd_audit: PREFIX|OPERATION|RESULT|FILE

The record fields are:

    • PREFIX - the result of the full_audit:prefix string after variable substitutions

    • OPERATION - the name of the VFS operation

    • RESULT - whether the operation succeeded or failed

    • FILE - the name of the file or directory the operation was performed on

This module is stackable.

OPTIONS

vfs_full_audit:prefix = STRING
    Prepend audit messages with STRING. STRING is processed for standard substitution variables listed in smb.conf(5). The default prefix is "%u|%I".

vfs_full_audit:success = LIST
    LIST is a list of VFS operations that should be recorded if they succeed. Operations are specified using the names listed above.

vfs_full_audit:failure = LIST
    LIST is a list of VFS operations that should be recorded if they failed. Operations are specified using the names listed above.

full_audit:facility = FACILITY
    Log messages to the named syslog(3) facility.

full_audit:priority = PRIORITY
    Log messages with the named syslog(3) priority.

EXAMPLES

Log file and directory open operations on the [records] share using the LOCAL7 facility and ALERT priority, including the username and IP address:

            [records]
    	path = /data/records
    	vfs objects = full_audit
    	full_audit:prefix = %u|%I
    	full_audit:success = open opendir
    	full_audit:failure = all
    	full_audit:facility = LOCAL7
    	full_audit:priority = ALERT

VERSION

This man page is correct for version 3.0.25 of the Samba suite.

AUTHOR

The original Samba software and related utilities were created by Andrew Tridgell. Samba is now developed by the Samba Team as an Open Source project similar to the way the Linux kernel is developed.