VFSFULLAUDIT(8) VFSFULLAUDIT(8)

NAME
       vfsfullaudit - record Samba VFS operations in the system log

SYNOPSIS
       vfs objects = fullaudit

DESCRIPTION
       This VFS module is part of the ssaammbbaa(7) suite.

       The vfsfullaudit VFS module records selected client operations to the
       system log using ssyysslloogg(3).

       vfsfullaudit is able to record the complete set of Samba  VFS  opera-
       tions:

          aiocancel

          aioerror

          aiofsync

          aioread

          aioreturn

          aiosuspend

          aiowrite

          chdir

          chflags

          chmod

          chmodacl

          chown

          close

          closedir

          connect

          disconnect

          diskfree

          fchmod

          fchmodacl

          fchown

          fgetntacl

          fgetxattr

          flistxattr

          fremovexattr

          fsetntacl

          fsetxattr

          fstat

          fsync

          ftruncate

          getntacl

          getquota

          getshadowcopydata

          getlock

          getwd

          getxattr

          kernelflock

          lgetxattr

          link

          linuxsetlease

          listxattr

          llistxattr

          lock

          lremovexattr

          lseek

          lsetxattr

          lstat

          mkdir

          mknod

          open

          opendir

          pread

          pwrite

          read

          readdir

          readlink

          realpath

          removexattr

          rename

          rewinddir

          rmdir

          seekdir

          sendfile

          setntacl

          setquota

          setxattr

          stat

          statvfs

          symlink

          sysacladdperm

          sysaclclearperms

          sysaclcreateentry

          sysacldeletedeffile

          sysaclfreeacl

          sysaclfreequalifier

          sysaclfreetext

          sysaclgetentry

          sysaclgetfd

          sysaclgetfile

          sysaclgetperm

          sysaclgetpermset

          sysaclgetqualifier

          sysaclgettagtype

          sysaclinit

          sysaclsetfd

          sysaclsetfile

          sysaclsetpermset

          sysaclsetqualifier

          sysaclsettagtype

          sysacltotext

          sysaclvalid

          telldir

          unlink

          utime

          write

       In  addition to these operations, vfsfullaudit recognizes the special
       operation names "all" and "none ", which refer to all  the  VFS  opera-
       tions and none of the VFS operations respectively.

       vfsfullaudit  records operations in fixed format consisting of fields
       separated by '|' characters. The format is:


                 smbdaudit: PREFIX|OPERATION|RESULT|FILE


       The record fields are:

       +o  PREFIX - the result of the fullaudit:prefix string  after  variable
          substitutions

       +o  OPERATION - the name of the VFS operation

       +o  RESULT - whether the operation succeeded or failed

       +o  FILE - the name of the file or directory the operation was performed
          on

       This module is stackable.

OOPPTTIIOONNSS
       vfsfullaudit:prefix = STRING
          Prepend audit messages with STRING. STRING is processed for standard
          substitution  variables listed in ssmmbb..ccoonnff(5). The default prefix is
          "%u|%I".

       vfsfullaudit:success = LIST
          LIST is a list of VFS operations that should  be  recorded  if  they
          succeed. Operations are specified using the names listed above.

       vfsfullaudit:failure = LIST
          LIST  is  a  list  of VFS operations that should be recorded if they
          failed. Operations are specified using the names listed above.

       fullaudit:facility = FACILITY
          Log messages to the named ssyysslloogg(3) facility.

       fullaudit:priority = PRIORITY
          Log messages with the named ssyysslloogg(3) priority.

EEXXAAMMPPLLEESS
       Log file and directory open operations on the [records] share using the
       LOCAL7  facility  and  ALERT  priority,  including  the username and IP
       address:


               [records]
            path = /data/records
            vfs objects = fullaudit
            fullaudit:prefix = %u|%I
            fullaudit:success = open opendir
            fullaudit:failure = all
            fullaudit:facility = LOCAL7
            fullaudit:priority = ALERT


VVEERRSSIIOONN
       This man page is correct for version 3.0.25 of the Samba suite.

AUTHOR       The original Samba software  and  related  utilities  were  created  by
       Andrew  Tridgell.  Samba  is now developed by the Samba Team as an Open
       Source project similar to the way the Linux kernel is developed.




                                                             VFSFULLAUDIT(8)