docs-xml/manpages/vfs_full_audit.8.xml

   1 <?xml version="1.0" encoding="iso-8859-1"?>
   2 <!DOCTYPE refentry PUBLIC "-//Samba-Team//DTD DocBook V4.2-Based Variant V1.0//EN" "http://www.samba.org/samba/DTD/samba-doc">
   3 <refentry id="vfs_full_audit.8">
   4
   5 <refmeta>
   6         <refentrytitle>vfs_full_audit</refentrytitle>
   7         <manvolnum>8</manvolnum>
   8         <refmiscinfo class="source">Samba</refmiscinfo>
   9         <refmiscinfo class="manual">System Administration tools</refmiscinfo>
  10         <refmiscinfo class="version">&doc.version;</refmiscinfo>
  11 </refmeta>
  12
  13
  14 <refnamediv>
  15         <refname>vfs_full_audit</refname>
  16         <refpurpose>record Samba VFS operations in the system log</refpurpose>
  17 </refnamediv>
  18
  19 <refsynopsisdiv>
  20         <cmdsynopsis>
  21                 <command>vfs objects = full_audit</command>
  22         </cmdsynopsis>
  23 </refsynopsisdiv>
  24
  25 <refsect1>
  26         <title>DESCRIPTION</title>
  27
  28         <para>This VFS module is part of the
  29         <citerefentry><refentrytitle>samba</refentrytitle>
  30         <manvolnum>7</manvolnum></citerefentry> suite.</para>
  31
  32         <para>The <command>vfs_full_audit</command> VFS module records selected
  33         client operations to the system log using
  34         <citerefentry><refentrytitle>syslog</refentrytitle>
  35         <manvolnum>3</manvolnum></citerefentry>.</para>
  36
  37         <para><command>vfs_full_audit</command> is able to record the
  38         complete set of Samba VFS operations:</para>
  39
  40         <simplelist>
  41         <member>aio_force</member>
  42         <member>audit_file</member>
  43         <member>brl_lock_windows</member>
  44         <member>brl_unlock_windows</member>
  45         <member>chdir</member>
  46         <member>close</member>
  47         <member>closedir</member>
  48         <member>connect</member>
  49         <member>connectpath</member>
  50         <member>create_dfs_pathat</member>
  51         <member>create_file</member>
  52         <member>disconnect</member>
  53         <member>disk_free</member>
  54         <member>durable_cookie</member>
  55         <member>durable_disconnect</member>
  56         <member>durable_reconnect</member>
  57         <member>fallocate</member>
  58         <member>fchflags</member>
  59         <member>fchmod</member>
  60         <member>fchown</member>
  61         <member>fcntl</member>
  62         <member>fdopendir</member>
  63         <member>fget_compression</member>
  64         <member>fget_dos_attributes</member>
  65         <member>fget_nt_acl</member>
  66         <member>fgetxattr</member>
  67         <member>file_id_create</member>
  68         <member>filesystem_sharemode</member>
  69         <member>flistxattr</member>
  70         <member>fntimes</member>
  71         <member>freaddir_attr</member>
  72         <member>fremovexattr</member>
  73         <member>fs_capabilities</member>
  74         <member>fsctl</member>
  75         <member>fset_dos_attributes</member>
  76         <member>fset_nt_acl</member>
  77         <member>fsetxattr</member>
  78         <member>fs_file_id</member>
  79         <member>fstat</member>
  80         <member>fstatat</member>
  81         <member>fstreaminfo</member>
  82         <member>fsync_recv</member>
  83         <member>fsync_send</member>
  84         <member>ftruncate</member>
  85         <member>get_alloc_size</member>
  86         <member>get_dfs_referrals</member>
  87         <member>get_dos_attributes_recv</member>
  88         <member>get_dos_attributes_send</member>
  89         <member>getlock</member>
  90         <member>get_quota</member>
  91         <member>get_real_filename</member>
  92         <member>get_real_filename_at</member>
  93         <member>get_shadow_copy_data</member>
  94         <member>getwd</member>
  95         <member>getxattrat_recv</member>
  96         <member>getxattrat_send</member>
  97         <member>is_offline</member>
  98         <member>lchown</member>
  99         <member>linkat</member>
 100         <member>linux_setlease</member>
 101         <member>lock</member>
 102         <member>lseek</member>
 103         <member>lstat</member>
 104         <member>mkdirat</member>
 105         <member>mknodat</member>
 106         <member>ntimes</member>
 107         <member>offload_read_recv</member>
 108         <member>offload_read_send</member>
 109         <member>offload_write_recv</member>
 110         <member>offload_write_send</member>
 111         <member>open</member>
 112         <member>openat</member>
 113         <member>parent_pathname</member>
 114         <member>pread</member>
 115         <member>pread_recv</member>
 116         <member>pread_send</member>
 117         <member>pwrite</member>
 118         <member>pwrite_recv</member>
 119         <member>pwrite_send</member>
 120         <member>read</member>
 121         <member>read_dfs_pathat</member>
 122         <member>readdir</member>
 123         <member>readlinkat</member>
 124         <member>realpath</member>
 125         <member>recvfile</member>
 126         <member>removexattr</member>
 127         <member>renameat</member>
 128         <member>rewinddir</member>
 129         <member>sendfile</member>
 130         <member>set_compression</member>
 131         <member>set_offline</member>
 132         <member>set_quota</member>
 133         <member>snap_check_path</member>
 134         <member>snap_create</member>
 135         <member>snap_delete</member>
 136         <member>stat</member>
 137         <member>statvfs</member>
 138         <member>strict_lock_check</member>
 139         <member>symlinkat</member>
 140         <member>sys_acl_blob_get_fd</member>
 141         <member>sys_acl_delete_def_fd</member>
 142         <member>sys_acl_get_fd</member>
 143         <member>sys_acl_set_fd</member>
 144         <member>translate_name</member>
 145         <member>unlinkat</member>
 146         <member>write</member>
 147         </simplelist>
 148
 149         <para>In addition to these operations,
 150         <command>vfs_full_audit</command> recognizes the special operation
 151         names &quot;all&quot; and &quot;none &quot;, which refer to all
 152         the VFS operations and none of the VFS operations respectively.
 153         </para>
 154
 155         <para>If an unknown operation name is used (for example an operation name
 156         is miss-spelled), the module will fail to load and clients will
 157         be refused connections to a share using this module.
 158         </para>
 159
 160         <para><command>vfs_full_audit</command> records operations in fixed
 161         format consisting of fields separated by '|' characters. The
 162         format is: </para>
 163         <programlisting>
 164                 smbd_audit: PREFIX|OPERATION|RESULT|FILE
 165         </programlisting>
 166
 167         <para>The record fields are:</para>
 168
 169         <itemizedlist>
 170         <listitem><para><command>PREFIX</command> - the result of the full_audit:prefix string after variable substitutions</para></listitem>
 171         <listitem><para><command>OPERATION</command> - the name of the VFS operation</para></listitem>
 172         <listitem><para><command>RESULT</command> - whether the operation succeeded or failed</para></listitem>
 173         <listitem><para><command>FILE</command> - the name of the file or directory the operation was performed on</para></listitem>
 174
 175         </itemizedlist>
 176
 177         <para>This module is stackable.</para>
 178
 179 </refsect1>
 180
 181
 182 <refsect1>
 183         <title>OPTIONS</title>
 184
 185         <variablelist>
 186
 187                 <varlistentry>
 188                 <term>full_audit:prefix = STRING</term>
 189                 <listitem>
 190                 <para>Prepend audit messages with STRING. STRING is
 191                 processed for standard substitution variables listed in
 192                 <citerefentry><refentrytitle>smb.conf</refentrytitle>
 193                 <manvolnum>5</manvolnum></citerefentry>. The default
 194                 prefix is &quot;%u|%I&quot;. </para>
 195
 196                 </listitem>
 197                 </varlistentry>
 198
 199                 <varlistentry>
 200                 <term>full_audit:success = LIST</term>
 201                 <listitem>
 202                 <para>LIST is a list of VFS operations that should be
 203                 recorded if they succeed. Operations are specified using
 204                 the names listed above. Operations can be unset by prefixing
 205                 the names with "!". The default is none operations.
 206                 </para>
 207
 208                 </listitem>
 209                 </varlistentry>
 210
 211                 <varlistentry>
 212                 <term>full_audit:failure = LIST</term>
 213                 <listitem>
 214                 <para>LIST is a list of VFS operations that should be
 215                 recorded if they failed. Operations are specified using
 216                 the names listed above. Operations can be unset by prefixing
 217                 the names with "!". The default is none operations.
 218                 </para>
 219
 220                 </listitem>
 221                 </varlistentry>
 222
 223                 <varlistentry>
 224                 <term>full_audit:facility = FACILITY</term>
 225                 <listitem>
 226                 <para>Log messages to the named
 227                 <citerefentry><refentrytitle>syslog</refentrytitle>
 228                 <manvolnum>3</manvolnum></citerefentry> facility.
 229
 230                 </para>
 231
 232                 </listitem>
 233                 </varlistentry>
 234
 235                 <varlistentry>
 236                 <term>full_audit:priority = PRIORITY</term>
 237                 <listitem>
 238                 <para>Log messages with the named
 239                 <citerefentry><refentrytitle>syslog</refentrytitle>
 240                 <manvolnum>3</manvolnum></citerefentry> priority.
 241                 </para>
 242
 243                 </listitem>
 244                 </varlistentry>
 245
 246                 <varlistentry>
 247                 <term>full_audit:syslog = true/false</term>
 248                 <listitem>
 249                 <para>Log messages to syslog (default) or as a debug level 1
 250                 message.
 251                 </para>
 252                 </listitem>
 253                 </varlistentry>
 254
 255                 <varlistentry>
 256                 <term>full_audit:log_secdesc = true/false</term>
 257                 <listitem>
 258                 <para>Log an sddl form of the security descriptor coming in
 259                 when a client sets an acl. Defaults to false.
 260                 </para>
 261                 </listitem>
 262                 </varlistentry>
 263
 264         </variablelist>
 265 </refsect1>
 266
 267 <refsect1>
 268         <title>EXAMPLES</title>
 269
 270         <para>Log file and directory open operations on the [records]
 271         share using the LOCAL7 facility and ALERT priority, including
 272         the username and IP address. Logging excludes the open VFS function
 273         on failures:</para>
 274
 275 <programlisting>
 276         <smbconfsection name="[records]"/>
 277         <smbconfoption name="path">/data/records</smbconfoption>
 278         <smbconfoption name="vfs objects">full_audit</smbconfoption>
 279         <smbconfoption name="full_audit:prefix">%u|%I</smbconfoption>
 280         <smbconfoption name="full_audit:success">open opendir</smbconfoption>
 281         <smbconfoption name="full_audit:failure">all !open</smbconfoption>
 282         <smbconfoption name="full_audit:facility">LOCAL7</smbconfoption>
 283         <smbconfoption name="full_audit:priority">ALERT</smbconfoption>
 284 </programlisting>
 285
 286 </refsect1>
 287
 288 <refsect1>
 289         <title>VERSION</title>
 290         <para>This man page is part of version &doc.version; of the Samba suite.
 291         </para>
 292 </refsect1>
 293
 294 <refsect1>
 295         <title>AUTHOR</title>
 296
 297         <para>The original Samba software and related utilities
 298         were created by Andrew Tridgell. Samba is now developed
 299         by the Samba Team as an Open Source project similar
 300         to the way the Linux kernel is developed.</para>
 301
 302 </refsect1>
 303
 304 </refentry>