Updated SMB/CIF auditing instructions for v11

[JohnL7]

I found the following threads here on the forum but they are all stale and for older versions of FreeNAS:

https://forums.freenas.org/index.php?threads/freenas-samba-full_audit-log-user-activity.10007/
https://forums.freenas.org/index.ph...on-samba-shares-full_audit-freenas-9-3.13840/
https://forums.freenas.org/index.ph...rs-activity-with-full_audit-vfs-object.10076/

I was looking at getting updated instructions that work with version 11.1 so I can get this setup. Does anyone have updated instructions as when I tried to get this working nothing appears to be logging the way the sample outputs are shown in the thread.

Thanks in advance!

 

[Johnny Fartpants]

I add this to my Auxiliary Parameters field in Services, SMB:

Code:

full_audit:prefix = %u|%I|%m|%S
full_audit:priority = notice
full_audit:failure = connect
full_audit:success = open mkdir unlink rmdir rename

and then on the Share itself add the VFS Object full_audit

 

[JohnL7]

I add this to my Auxiliary Parameters field in Services, SMB:

Code:

full_audit:prefix = %u|%I|%m|%S
full_audit:priority = notice
full_audit:failure = connect
full_audit:success = open mkdir unlink rmdir rename

and then on the Share itself add the VFS Object full_audit

Did you need to restart any services? Reboot the entire box? I also wanted to confirm that this just modifies the entries being sent to the messages log and not anywhere else correct?

 

[frouty]

Hi,
@Johnny Fartpants I made what you write :
- auxiliary parameters for service samba,
- full_audit in a share dataset
- restart the SMB service.

And from an other linux machine client did a : smbclient //ip_freenas/a_share_dataset.
I connect , I can
smb: \> mkdir test5 # to try

I look in log in freenas : tail -f /var/log/samba4/log.smbd , nmbd and others but nothing happens.

What did I miss?
Thanks
FreeNAS-11.2-RC2

 

[Johnny Fartpants]

/var/log/messages

 

[frouty]

OK thanks

I add
log level = 3 passdb:5 auth:5 <------ pour augmenter la verbosité des logs.
in the /usr/local/etc/smb4.conf [global]
And I got enough info to fix my problem.

Is it more interesting to use the full-audit auxiliary parameters?