Re: samba Unmatched Entries

Willi Mann wrote:
> Do you never look at your raw logfiles?

Of course. Until I installed logwatch, I closely monitored the raw logs. 
What's your point?


> If I can split out data earlier, I do it. And it's much easier to handle 
> the case when a service went crazy and filled your logs with garbage. I 
> have this issue sometimes with squid and crazy windows machines.

True. That's a good argument for using Syslog-ng.


>>> Unfortunately, per default there's one logfile per IP 
>>> instead of the log.smbd logfile.
>> There should be both. The ones with machine names or IP addresses are 
>> the client-specific debug logs.
> 
> That's just because %m can't always be resolved. As far as I understand 
> it, log.smbd and log.$ip should always be disjunct.

I actually haven't compared the client logs with the regular logs to see 
how they differ. The man pages don't shed any light on the situation. 
The client logs may contain extra detail that is client specific, or 
they may contain lines that are client specific, but also replicated in 
log.smbd.


> But splitting per client is too much distribution IMHO.

I suspect if you drop the %m from the log file specification you'll get 
just the two main log files.


> I would say, log rotation should be better configured in the default 
> configuration.

I've sent an inquiry to the maintainers of the Debian smaba package. If 
I don't hear back from them by next week, I'll open a bug there.


> The smb.conf manpage calls all logging "debug logging", probably because 
> in SAMBA, there is a macro call DEBUG_PRINT or the like...

Yes, probably.

  -Tom

-- 
Tom Metro
Venture Logic, Newton, MA, USA
"Enterprise solutions through open source."
Professional Profile: http://tmetro.venturelogic.com/