docs-xml/manpages-3/vfs_smb_traffic_analyzer.8.xml

   1 <?xml version="1.0" encoding="iso-8859-1"?>
   2 <!DOCTYPE refentry PUBLIC "-//Samba-Team//DTD DocBook V4.2-Based Variant V1.0//EN" "http://www.samba.org/samba/DTD/samba-doc">
   3 <refentry id="vfs_smb_traffic_analyzer.8">
   4
   5 <refmeta>
   6         <refentrytitle>smb_traffic_analyzer</refentrytitle>
   7         <manvolnum>8</manvolnum>
   8         <refmiscinfo class="source">Samba</refmiscinfo>
   9         <refmiscinfo class="manual">System Administration tools</refmiscinfo>
  10         <refmiscinfo class="version">3.3</refmiscinfo>
  11 </refmeta>
  12
  13
  14 <refnamediv>
  15         <refname>vfs_smb_traffic_analyzer</refname>
  16         <refpurpose>log Samba VFS read and write operations through a socket
  17         to a helper application</refpurpose>
  18 </refnamediv>
  19
  20 <refsynopsisdiv>
  21         <cmdsynopsis>
  22                 <command>vfs objects = smb_traffic_analyzer</command>
  23         </cmdsynopsis>
  24 </refsynopsisdiv>
  25
  26 <refsect1>
  27         <title>DESCRIPTION</title>
  28
  29         <para>This VFS module is part of the
  30         <citerefentry><refentrytitle>samba</refentrytitle>
  31         <manvolnum>7</manvolnum></citerefentry> suite.</para>
  32
  33         <para>The <command>vfs_smb_traffic_analyzer</command> VFS module logs
  34         client write and read operations on a Samba server and sends this data
  35         over a socket to a helper program, which feeds a SQL database. More
  36         information on the helper programs can be obtained from the
  37         homepage of the project at:
  38         http://holger123.wordpress.com/smb-traffic-analyzer/
  39         </para>
  40         <para><command>vfs_smb_traffic_analyzer</command> currently is aware
  41         of the following VFS operations:</para>
  42
  43         <simplelist>
  44         <member>write</member>
  45         <member>pwrite</member>
  46         <member>read</member>
  47         <member>pread</member>
  48         </simplelist>
  49
  50         <para><command>vfs_smb_traffic_analyzer</command> sends the following data
  51         in a fixed format seperated by a comma through either an internet or a
  52         unix domain socket:</para>
  53         <programlisting>
  54         BYTES|USER|DOMAIN|READ/WRITE|SHARE|FILENAME|TIMESTAMP
  55         </programlisting>
  56
  57         <para>Description of the records:
  58
  59         <itemizedlist>
  60         <listitem><para><command>BYTES</command> - the length in bytes of the VFS operation</para></listitem>
  61         <listitem><para><command>USER</command> - the user who initiated the operation</para></listitem>
  62         <listitem><para><command>DOMAIN</command> - the domain of the user</para></listitem>
  63         <listitem><para><command>READ/WRITE</command> - either "W" for a write operation or "R" for read</para></listitem>
  64         <listitem><para><command>SHARE</command> - the name of the share on which the VFS operation occured</para></listitem>
  65         <listitem><para><command>FILENAME</command> - the name of the file that was used by the VFS operation</para></listitem>
  66         <listitem><para><command>TIMESTAMP</command> - a timestamp, formatted as "yyyy-mm-dd hh-mm-ss.ms" indicating when the VFS operation occured</para></listitem>
  67         </itemizedlist>
  68
  69         </para>
  70
  71         <para>This module is stackable.</para>
  72
  73 </refsect1>
  74
  75
  76 <refsect1>
  77         <title>OPTIONS</title>
  78
  79         <variablelist>
  80
  81                 <varlistentry>
  82                 <term>smb_traffic_analyzer:mode = STRING</term>
  83                 <listitem>
  84                 <para>If STRING matches to "unix_domain_socket", the module will
  85                 use a unix domain socket located at /var/tmp/stadsocket, if
  86                 STRING contains an different string or is not defined, the module will
  87                 use an internet domain socket for data transfer.</para>
  88
  89                 </listitem>
  90                 </varlistentry>
  91
  92
  93                 <varlistentry>
  94                 <term>smb_traffic_analyzer:host = STRING</term>
  95                 <listitem>
  96                 <para>The module will send the data to the system named with
  97                 the hostname STRING.</para>
  98
  99                 </listitem>
 100                 </varlistentry>
 101
 102                 <varlistentry>
 103                 <term>smb_traffic_analyzer:port = STRING</term>
 104                 <listitem>
 105                 <para>The module will send the data using the TCP port given
 106                 in STRING.
 107                 </para>
 108                 </listitem>
 109                 </varlistentry>
 110                 <varlistentry>
 111                 <term>smb_traffic_analyzer:anonymize_prefix = STRING</term>
 112                 <listitem>
 113                 <para>The module will replace the user names with a prefix
 114                 given by STRING and a simple hash number.
 115                 </para>
 116
 117                 </listitem>
 118                 </varlistentry>
 119
 120
 121         </variablelist>
 122 </refsect1>
 123
 124 <refsect1>
 125         <title>EXAMPLES</title>
 126
 127         <para>The module running on share "example_share", using a unix domain socket</para>
 128         <programlisting>
 129         <smbconfsection name="[example_share]"/>
 130         <smbconfoption name="path">/data/example</smbconfoption>
 131         <smbconfoption name="vfs objects">smb_traffic_analyzer</smbconfoption>
 132         <smbconfoption name="smb_traffic_analyzer:mode">unix_domain_socket</smbconfoption>
 133         </programlisting>
 134
 135         <para>The module running on share "example_share", using an internet socket,
 136         connecting to host "examplehost" on port 3491.</para>
 137         <programlisting>
 138         <smbconfsection name="[example_share]"/>
 139         <smbconfoption name="path">/data/example</smbconfoption>
 140         <smbconfoption name="vfs objects">smb_traffic_analyzer</smbconfoption>
 141         <smbconfoption name="smb_traffic_analyzer:host">examplehost</smbconfoption>
 142         <smbconfoption name="smb_traffic_analyzer:port">3491</smbconfoption>
 143         </programlisting>
 144
 145         <para>The module running on share "example_share", using an internet socket,
 146         connecting to host "examplehost" on port 3491, anonymizing user names with
 147         the prefix "User".</para>
 148         <programlisting>
 149         <smbconfsection name="[example_share]"/>
 150         <smbconfoption name="path">/data/example</smbconfoption>
 151         <smbconfoption name="vfs objects">smb_traffic_analyzer</smbconfoption>
 152         <smbconfoption name="smb_traffic_analyzer:host">examplehost</smbconfoption>
 153         <smbconfoption name="smb_traffic_analyzer:port">3491</smbconfoption>
 154         <smbconfoption name="smb_traffic_analyzer:anonymize_prefix">User</smbconfoption>
 155         </programlisting>
 156 </refsect1>
 157
 158 <refsect1>
 159         <title>VERSION</title>
 160         <para>This man page is correct for version 3.3 of the Samba suite.
 161         </para>
 162 </refsect1>
 163
 164 <refsect1>
 165         <title>AUTHOR</title>
 166
 167         <para>The original Samba software and related utilities
 168         were created by Andrew Tridgell. Samba is now developed
 169         by the Samba Team as an Open Source project similar
 170         to the way the Linux kernel is developed.</para>
 171
 172         <para>The original version of the VFS module and the
 173         helper tools were created by Holger Hetterich.</para>
 174 </refsect1>
 175
 176 </refentry>