1VFS_FULL_AUDIT(8)         System Administration tools        VFS_FULL_AUDIT(8)
2
3
4

NAME

6       vfs_full_audit - record Samba VFS operations in the system log
7

SYNOPSIS

9       vfs objects = full_audit
10

DESCRIPTION

12       This VFS module is part of the samba(7) suite.
13
14       The vfs_full_audit VFS module records selected client operations to the
15       system log using syslog(3).
16
17       vfs_full_audit is able to record the complete set of Samba VFS
18       operations:
19           aio_force
20           audit_file
21           brl_lock_windows
22           brl_unlock_windows
23           chdir
24           chflags
25           chmod
26           close
27           closedir
28           connect
29           connectpath
30           create_dfs_pathat
31           create_file
32           disconnect
33           disk_free
34           durable_cookie
35           durable_disconnect
36           durable_reconnect
37           fallocate
38           fchmod
39           fchown
40           fdopendir
41           fget_dos_attributes
42           fget_nt_acl_at
43           fgetxattr
44           file_id_create
45           flistxattr
46           fremovexattr
47           fs_capabilities
48           fsctl
49           fset_dos_attributes
50           fset_nt_acl
51           fsetxattr
52           fs_file_id
53           fstat
54           fsync
55           fsync_recv
56           fsync_send
57           ftruncate
58           get_alloc_size
59           get_compression
60           get_dfs_referrals
61           get_dos_attributes
62           get_dos_attributes_recv
63           get_dos_attributes_send
64           getlock
65           get_nt_acl
66           get_quota
67           get_real_filename
68           get_shadow_copy_data
69           getwd
70           getxattr
71           getxattrat_recv
72           getxattrat_send
73           is_offline
74           kernel_flock
75           lchown
76           linkat
77           linux_setlease
78           listxattr
79           lock
80           lseek
81           lstat
82           mkdirat
83           mknodat
84           ntimes
85           offload_read_recv
86           offload_read_send
87           offload_write_recv
88           offload_write_send
89           open
90           pread
91           pread_recv
92           pread_send
93           pwrite
94           pwrite_recv
95           pwrite_send
96           read
97           readdir
98           readdir_attr
99           readlinkat
100           realpath
101           recvfile
102           removexattr
103           renameat
104           rewinddir
105           seekdir
106           sendfile
107           set_compression
108           set_dos_attributes
109           set_offline
110           set_quota
111           setxattr
112           snap_check_path
113           snap_create
114           snap_delete
115           stat
116           statvfs
117           streaminfo
118           strict_lock_check
119           symlinkat
120           sys_acl_blob_get_fd
121           sys_acl_blob_get_file
122           sys_acl_delete_def_file
123           sys_acl_get_fd
124           sys_acl_get_file
125           sys_acl_set_fd
126           sys_acl_set_file
127           telldir
128           translate_name
129           unlinkat
130           write
131
132       In addition to these operations, vfs_full_audit recognizes the special
133       operation names "all" and "none ", which refer to all the VFS
134       operations and none of the VFS operations respectively.
135
136       vfs_full_audit records operations in fixed format consisting of fields
137       separated by '|' characters. The format is:
138
139                     smbd_audit: PREFIX|OPERATION|RESULT|FILE
140
141
142       The record fields are:
143
144              ·   PREFIX - the result of the full_audit:prefix string after
145                  variable substitutions
146
147              ·   OPERATION - the name of the VFS operation
148
149              ·   RESULT - whether the operation succeeded or failed
150
151              ·   FILE - the name of the file or directory the operation was
152                  performed on
153
154
155       This module is stackable.
156

OPTIONS

158       full_audit:prefix = STRING
159           Prepend audit messages with STRING. STRING is processed for
160           standard substitution variables listed in smb.conf(5). The default
161           prefix is "%u|%I".
162
163       full_audit:success = LIST
164           LIST is a list of VFS operations that should be recorded if they
165           succeed. Operations are specified using the names listed above.
166           Operations can be unset by prefixing the names with "!". The
167           default is none operations.
168
169       full_audit:failure = LIST
170           LIST is a list of VFS operations that should be recorded if they
171           failed. Operations are specified using the names listed above.
172           Operations can be unset by prefixing the names with "!". The
173           default is none operations.
174
175       full_audit:facility = FACILITY
176           Log messages to the named syslog(3) facility.
177
178       full_audit:priority = PRIORITY
179           Log messages with the named syslog(3) priority.
180
181       full_audit:syslog = true/false
182           Log messages to syslog (default) or as a debug level 1 message.
183
184       full_audit:log_secdesc = true/false
185           Log an sddl form of the security descriptor coming in when a client
186           sets an acl. Defaults to false.
187

EXAMPLES

189       Log file and directory open operations on the [records] share using the
190       LOCAL7 facility and ALERT priority, including the username and IP
191       address. Logging excludes the open VFS function on failures:
192
193                   [records]
194                path = /data/records
195                vfs objects = full_audit
196                full_audit:prefix = %u|%I
197                full_audit:success = open opendir
198                full_audit:failure = all !open
199                full_audit:facility = LOCAL7
200                full_audit:priority = ALERT
201

VERSION

203       This man page is part of version 4.13.7 of the Samba suite.
204

AUTHOR

206       The original Samba software and related utilities were created by
207       Andrew Tridgell. Samba is now developed by the Samba Team as an Open
208       Source project similar to the way the Linux kernel is developed.
209
210
211
212Samba 4.13.7                      03/25/2021                 VFS_FULL_AUDIT(8)
Impressum