Samba auditing

Russell Coker via linux-aus <[email protected]> Mon, 20 Jan 2025 17:25:44 +1100

Newsgroups	gmane.linux.australia
Message-ID	<3330534.aeNJFYEL58@cupcakke>

vfs objects = full_audit
full_audit:prefix = %u|%I|%S
full_audit:success = renameat rename unlinkat create_dfs_pathat create_file 
unlink write pwrite
full_audit:failure = renameat rename unlinkat create_dfs_pathat create_file 
unlink write pwrite
full_audit:facility = local5
full_audit:priority = notice

I've setup Samba auditing with the above as the main config with the below as 
the documentation I used.

https://access.redhat.com/solutions/7011345
https://tinyurl.com/27eeo32s

I'm getting hundreds of thousands of audit entries like the following:

2025-01-16T14:45:27.232887+11:00 $SERVER smbd_audit: $USER|$IP|$SHARENAME|
create_file|ok|0x100081|file|open|$DIRNAME

It gives this about create_file on directories.  Why does it do that?

-- 
My Main Blog         http://etbe.coker.com.au/
My Documents Blog    http://doc.coker.com.au/



_______________________________________________
linux-aus mailing list
[email protected]
http://lists.linux.org.au/mailman/listinfo/linux-aus

To unsubscribe from this list, send a blank email to
linux-aus-unsubscribe-cunTk1MwBs8iFSDQTTA3OBCuuivNXqWP@public.gmane.org