Samba4 Logging, Logs and Location Question

[onigiri]

Hi Friends!

So, it has been reported that users are getting intermittent issues with permissions. Of course, what I have from the end user is: "Our process ran and after 5 days it failed to read a file with a permission error"

We are a GIS firm and to process map data can sometime take hours to weeks. If at any point a disconnect for any reason occurs, the process needs to start all over again.

I have been reading into setting up logging on the SMB service to be able to find out who is doing what and when so that the next time they bring up an issue I will be able to see what the log says for that time frame.

Here is the issue, all the tutorials on this forum for for setting up vfs_objects of audit or full_audit for version 9 or under. It appears to me that simply turning on logging:normal in the SMB service writes items like this to the /var/log/samba4/log.smbd file:

[2018/07/26 19:24:30.533964, 2] ../source3/smbd/close.c:789(close_normal_file)
DOMAIN\USER closed file file.ext (numopen=27) NT_STATUS_OK

Just watching the log.smbd file for the last 30 minutes, it is already getting quite big as we have alot of users that are active 24/7. I cannot for the life of me find how to redirect or change the directory of the log.smbd file. Again there is ample tutorials for the full_audit method of setting up SMB logging.

Should I not be using the logging=normal in the SMB service and go the vfs_objects full_audit route with 11.1u5?

Does anyone have any other tip or instructions to get the best log to see user file access and if there is any authentication issue or connection drop?

Thanks in advance.

 

[anodos]

vfs_full_audit is a good option in this use case. It does need to be configured correctly to narrow down the specific vfs operations you want to log (both in the allow and deny categories).

https://www.samba.org/samba/docs/current/man-html/vfs_full_audit.8.html

Example auxiliary parameters:

Code:

	full_audit:success = unlink
   full_audit:failure = unlink

Logs all delete operations.

 

[onigiri]

Thanks for the reply anodos. The documentation does not provide me with the instructions to change the log location, which is my primary goal. Just turning on 'normal' logging for the SMB gives me what i need in the samba4 log but only keeps 50MB (2hrs of data) then recycles itself.

 

[anodos]

Thanks for the reply anodos. The documentation does not provide me with the instructions to change the log location, which is my primary goal. Just turning on 'normal' logging for the SMB gives me what i need in the samba4 log but only keeps 50MB (2hrs of data) then recycles itself.

full_audit gets logged to /var/log/messages

 

[onigiri]

Yes, I found that out. Is there a way to make it goto a different log that I can put on the /mnt/ ? Also, does changing the SMB Service attributes reboot the SMB Service? I think when I added the full_audit attributes to the SMB service and hit save that it disconnected everyone in my organization from the share. Which is a problem when people have database files open that get locked.

 

[anodos]

Yes, I found that out. Is there a way to make it goto a different log that I can put on the /mnt/ ? Also, does changing the SMB Service attributes reboot the SMB Service? I think when I added the full_audit attributes to the SMB service and hit save that it disconnected everyone in my organization from the share. Which is a problem when people have database files open that get locked.

Any time you make a change under services->smb, the samba server will restart. This is by design because it is making changes to the [global] portion of the smb.conf.

 

[onigiri]

Thanks Anodos. I know you mentioned that the full_audit goes to messages, is there a way to prevent that? My messages is getting quite large and i have it already going to my /mnt/Tank/logs/smb/activity.log