Re: Samba auditing

On Monday, 20 January 2025 17:25:44 AEDT Russell Coker wrote:
> vfs objects = full_audit
> full_audit:prefix = %u|%I|%S
> full_audit:success = renameat rename unlinkat create_dfs_pathat create_file
> unlink write pwrite
> full_audit:failure = renameat rename unlinkat create_dfs_pathat create_file
> unlink write pwrite
> full_audit:facility = local5
> full_audit:priority = notice

The above audit lines were from one of my later attempts, where I added 
"unlink" not realising that "unlinkat" covers it and "unlink" is invalid.

Below is what I'm using now:

full_audit:success = renameat unlinkat create_dfs_pathat create_file write 
pwrite mkdirat linkat
full_audit:failure = renameat unlinkat create_dfs_pathat create_file write 
pwrite mkdirat linkat

-- 
My Main Blog         http://etbe.coker.com.au/
My Documents Blog    http://doc.coker.com.au/



_______________________________________________
linux-aus mailing list
[email protected]
http://lists.linux.org.au/mailman/listinfo/linux-aus

To unsubscribe from this list, send a blank email to
linux-aus-unsubscribe-cunTk1MwBs8iFSDQTTA3OBCuuivNXqWP@public.gmane.org