6

I am working over the default Samba that comes with RHEL 6.x version. I am successful in sharing a samba share to my client users.

I have given each of them a set of credentials using which they have to connect to samba server and upload or download their files.

I am able to log the details like which is file is found in the samba share at a point of time in the file like samba.log.server but it is not so clear that which user uploaded which file or which user downloaded which file.

Moreover I could not be able to log the details like when a file is removed from the samba share by which user.

Could anyone help me in getting or tracking the above required details?

  • I looked into this a while back and it turns out there aren't really a lot of great options for you. I ended up not being able to make any of them work and instead just yelled at my users to stop deleting files...that didn't work either. – David King Nov 16 '15 at 18:45

2 Answers2

5

It seems like the vfs_full_audit feature should get you the required info:

Based on instructions found here I think you should get it to work like this, Add the following to smb.conf and restart Samba:

vfs objects = full_audit
full_audit:prefix = %u|%I|%m|%S
full_audit:success = unlink open 
full_audit:failure = none
full_audit:priority = NOTICE
Greg Askew
  • 35,880
  • 5
  • 54
  • 82
Bert Neef
  • 316
  • 1
  • 5
0

Thank you Bert Neef for trying to answer the question. But with or without the above lines in the smb.conf file, I found the a line in the log file with the client's hostname as below:

reply_unlink : file1

when I deleted the file1. This is observed by doing many trails. So, this log entry in the samab log files may help us to know if the user deletes a file from the samba shares by connecting from the samba clients.