samba Unmatched Entries

Tom Metro <[email protected]>
Newsgroups gmane.comp.log.logwatch.devel
Message-ID <[email protected]> 
Weeks after my initial install of logwatch, I got around to fixing my 
samba log file group config to point to the correct log files (this 
would have been caught sooner if logwatch reported when logfiles were 
missing), and the first (and subsequent) report contained a pile of 
unmatched entries (see below).

These are debug entries from a debug log, and it looks to me, based on 
this report, that the samba service filter wasn't designed to handle 
debug messages. This seems odd, as the samba log file group config was 
by default pointing to where the debug logs are stored. (Normally samba 
logging is done through syslog. The samba log file group config doesn't 
even look at the syslog logs.)

Briefly looking at the service filter code, it does look like there are 
some expressions to match debug entries, so I'm not sure why there are 
so many unmatched entries, unless the filter was designed for a 
different samba version, or an expectation of a lower debug level.

It seems one way to address this issue would be switching the group 
config to monitor syslog files instead of the debug logs, and include 
some comments in the config file indicating what syslog logging level 
the service filter is designed to handle. (Anyone who needs more detail 
can always use the debug logs for that.)

I'm running samba version 3.0.24 (on Debian Etch) with the following 
logging related lines in /etc/samba/smb.conf:

         log level = 2
         syslog = 1
         log file = /var/log/samba/%m.log

  -Tom

-------- Original Message --------
[...]
  --------------------- samba Begin ------------------------


  Opened Sessions:
[ ...a normal looking report of what users connected and where from... ]

  **Unmatched Entries**
  auth/auth.c:check_ntlm_password(309)  check_ntlm_password: 
authentication for user [Administrator] -> [user1] -> [user1] succeeded 
: 26 Time(s)
  auth/auth.c:check_ntlm_password(309)  check_ntlm_password: 
authentication for user [user2] -> [user2] -> [user2] succeeded : 4 Time(s)
  lib/debug.c:reopen_logs(625)  Unable to open new log file 
/var/log/samba/clients/client2.log: No such file or directory : 1 Time(s)
  lib/debug.c:reopen_logs(625)  Unable to open new log file 
/var/log/samba/clients/client1.log: No such file or directory : 1 Time(s)
  lib/dmallocmsg.c:register_dmalloc_msgs(71)  Registered 
MSG_REQ_DMALLOC_MARK and LOG_CHANGED : 4 Time(s)
  lib/interface.c:add_interface(81)  added interface ip=192.168.0.35 
bcast=192.168.0.255 nmask=255.255.255.0 : 6 Time(s)
  lib/tallocmsg.c:register_msg_pool_usage(61)  Registered 
MSG_REQ_POOL_USAGE : 4 Time(s)
  nmbd/nmbd.c:main(723)  Becoming a daemon. : 2 Time(s)
 
nmbd/nmbd_browsesync.c:announce_local_master_browser_to_domain_master_browser(108) 
  announce_local_master_browser_to_domain_master_browser:  We are both a 
domain and a local master browser for workgroup UNIVERSE.  Do not 
announce to ourselves. : 47 Time(s)
  nmbd/nmbd_browsesync.c:sync_with_dmb(152)  sync_with_dmb:  Initiating 
sync with domain master browser host1<20> at IP 192.168.0.35 for 
workgroup UNIVERSE : 47 Time(s)
  nmbd/nmbd_elections.c:run_elections(204)  run_elections: >>> Won 
election for workgroup UNIVERSE on subnet 192.168.0.35 <<< : 2 Time(s)
  nmbd/nmbd_elections.c:send_election_dgram(41)  send_election_dgram: 
Sending election packet for workgroup UNIVERSE on subnet 192.168.0.35 : 
10 Time(s)
  nmbd/nmbd_subnetdb.c:make_subnet(144)  making subnet name:192.168.0.35 
Broadcast address:192.168.0.255 Subnet mask:255.255.255.0 : 2 Time(s)
  nmbd/nmbd_subnetdb.c:make_subnet(144)  making subnet 
name:REMOTE_BROADCAST_SUBNET Broadcast address:0.0.0.0 Subnet 
mask:0.0.0.0 : 2 Time(s)
  nmbd/nmbd_subnetdb.c:make_subnet(144)  making subnet 
name:UNICAST_SUBNET Broadcast address:192.168.0.35 Subnet 
mask:192.168.0.35 : 2 Time(s)
  nmbd/nmbd_subnetdb.c:make_subnet(144)  making subnet 
name:WINS_SERVER_SUBNET Broadcast address:0.0.0.0 Subnet mask:0.0.0.0 : 
2 Time(s)
  param/loadparm.c:do_section(3712)  Processing section "[Laser]" : 4 
Time(s)
  param/loadparm.c:do_section(3712)  Processing section "[backups]" : 4 
Time(s)
  param/loadparm.c:do_section(3712)  Processing section "[homes]" : 4 
Time(s)
  param/loadparm.c:do_section(3712)  Processing section "[printers]" : 4 
Time(s)
  param/loadparm.c:do_section(3712)  Processing section "[workstations]" 
: 4 Time(s)
  smbd/close.c:close_normal_file(344)  user1 closed file 
host1/log/07-07-04-dovecot-restart.txt (numopen=0)  : 4 Time(s)
  smbd/close.c:close_normal_file(344)  user1 closed file 
host1/log/07-07-04-dovecot-restart.txt (numopen=1)  : 1 Time(s)
  smbd/close.c:close_normal_file(344)  user1 closed file 
host1/log/07-07-04-dovecot-restart.txt.tmp (numopen=0)  : 27 Time(s)
  smbd/close.c:close_normal_file(344)  user1 closed file 
host1/log/07-07-05-SOAP-Lite.txt (numopen=0)  : 1 Time(s)
  smbd/close.c:close_normal_file(344)  user1 closed file 
host1/log/07-07-05-SOAP-Lite.txt (numopen=1)  : 2 Time(s)
  smbd/close.c:close_normal_file(344)  user1 closed file 
host1/log/07-07-05-apache.txt (numopen=0)  : 1 Time(s)
  smbd/close.c:close_normal_file(344)  user1 closed file 
host1/log/07-07-05-apache.txt (numopen=1)  : 2 Time(s)
  smbd/close.c:close_normal_file(344)  user1 closed file 
host1/log/07-07-05-apache.txt.tmp (numopen=0)  : 2 Time(s)
  smbd/close.c:close_normal_file(344)  user1 closed file 
host1/log/07-07-05-samba-logging.txt (numopen=0)  : 1 Time(s)
  smbd/close.c:close_normal_file(344)  user1 closed file 
host1/log/07-07-05-samba-logging.txt (numopen=1)  : 2 Time(s)
  smbd/close.c:close_normal_file(344)  user1 closed file 
host1/log/07-07-05-samba-logging.txt.tmp (numopen=0)  : 3 Time(s)
  smbd/open.c:open_file(352)  Administrator opened file 
host1/log/07-07-04-dovecot-restart.txt read=No write=Yes (numopen=1) : 2 
Time(s)
  smbd/open.c:open_file(352)  Administrator opened file 
host1/log/07-07-04-dovecot-restart.txt read=Yes write=No (numopen=1) : 2 
Time(s)
  smbd/open.c:open_file(352)  Administrator opened file 
host1/log/07-07-04-dovecot-restart.txt read=Yes write=No (numopen=2) : 1 
Time(s)
  smbd/open.c:open_file(352)  Administrator opened file 
host1/log/07-07-04-dovecot-restart.txt.tmp read=No write=No (numopen=1) 
: 1 Time(s)
  smbd/open.c:open_file(352)  Administrator opened file 
host1/log/07-07-04-dovecot-restart.txt.tmp read=No write=Yes (numopen=1) 
: 26 Time(s)
  smbd/open.c:open_file(352)  Administrator opened file 
host1/log/07-07-05-SOAP-Lite.txt read=No write=No (numopen=2) : 1 Time(s)
  smbd/open.c:open_file(352)  Administrator opened file 
host1/log/07-07-05-SOAP-Lite.txt read=No write=Yes (numopen=1) : 1 Time(s)
  smbd/open.c:open_file(352)  Administrator opened file 
host1/log/07-07-05-SOAP-Lite.txt read=No write=Yes (numopen=2) : 1 Time(s)
  smbd/open.c:open_file(352)  Administrator opened file 
host1/log/07-07-05-apache.txt read=No write=No (numopen=2) : 1 Time(s)
  smbd/open.c:open_file(352)  Administrator opened file 
host1/log/07-07-05-apache.txt read=No write=Yes (numopen=1) : 1 Time(s)
  smbd/open.c:open_file(352)  Administrator opened file 
host1/log/07-07-05-apache.txt read=No write=Yes (numopen=2) : 1 Time(s)
  smbd/open.c:open_file(352)  Administrator opened file 
host1/log/07-07-05-apache.txt.tmp read=No write=No (numopen=1) : 1 Time(s)
  smbd/open.c:open_file(352)  Administrator opened file 
host1/log/07-07-05-apache.txt.tmp read=No write=Yes (numopen=1) : 1 Time(s)
  smbd/open.c:open_file(352)  Administrator opened file 
host1/log/07-07-05-samba-logging.txt read=No write=No (numopen=2) : 1 
Time(s)
  smbd/open.c:open_file(352)  Administrator opened file 
host1/log/07-07-05-samba-logging.txt read=No write=Yes (numopen=1) : 1 
Time(s)
  smbd/open.c:open_file(352)  Administrator opened file 
host1/log/07-07-05-samba-logging.txt read=No write=Yes (numopen=2) : 1 
Time(s)
  smbd/open.c:open_file(352)  Administrator opened file 
host1/log/07-07-05-samba-logging.txt.tmp read=No write=No (numopen=1) : 
1 Time(s)
  smbd/open.c:open_file(352)  Administrator opened file 
host1/log/07-07-05-samba-logging.txt.tmp read=No write=Yes (numopen=1) : 
2 Time(s)
  smbd/process.c:timeout_processing(1393)  Closing idle connection : 11 
Time(s)
  smbd/reply.c:reply_special(496)  netbios connect: name1=host1 
     name2=client2            : 13 Time(s)
  smbd/reply.c:reply_special(496)  netbios connect: name1=host1 
     name2=client1          : 2 Time(s)
  smbd/reply.c:reply_special(503)  netbios connect: local=host1 
remote=client2, name type = 0 : 13 Time(s)
  smbd/reply.c:reply_special(503)  netbios connect: local=host1 
remote=client1, name type = 0 : 2 Time(s)
  smbd/reply.c:reply_tcon_and_X(711)  Serving IPC$ as a Dfs root : 19 
Time(s)
  smbd/reply.c:reply_tcon_and_X(711)  Serving backups as a Dfs root : 2 
Time(s)
  smbd/reply.c:reply_tcon_and_X(711)  Serving workstations as a Dfs root 
: 6 Time(s)
  smbd/server.c:open_sockets_smbd(384)  waiting for a connection : 2 Time(s)
  smbd/sesssetup.c:setup_new_vc_session(799)  setup_new_vc_session: New 
VC == 0, if NT4.x compatible we would close all old resources. : 28 Time(s)

  ---------------------- samba End -------------------------
[...]

  ###################### Logwatch End #########################
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.