Topic: Log partizione samba

[Spillo]

Salve,

ultimamente ho avuto un po di cartelle cancellate sul server, recuperate dal bck mi farebbe comodo capire chi sia stato. Se non ricordo male in una installazione standard questa funzionalita non è attiva, si deve attivare qualche parametro per avere i log di chi cancella cartelle o file?
(auditing???)

P.S. ho trovato questo... https://wiki.contribs.org/Audit_Tools   farebbe al caso mio? qualcuno ha avuto modo di provarlo????

danghiù

[mmccarn]

Samba Audit logging can be enabled for ibays using a db variable.  For user samba shares you would need a custom template fragment.

Here is a forum post from last year about enabling samba audit logs for ibays:
https://forums.contribs.org/index.php/topic,53486.msg277770.html#msg277770

To enable audit logging for the ibay named "fileshare":

Code: [Select]

db accounts setprop fileshare Audit enabled
signal-event ibay-modify fileshare

To enable audit logging for every ibay on your server:

Code: [Select]

for ibay in $(db accounts show |grep \=ibay |cut -d= -f1); do db accounts setprop $ibay Audit enabled; done
signal-event ibay-modify

Samba activity is then logged in /var/log/samba/samba_audit

[mmccarn]

I have added some notes on this to the wiki:
https://wiki.contribs.org/Useful_Commands#enable_samba_audit_logs_for_ibays

[Spillo]

hi,

Ok, thank you for the info .... this weekend I'll try on a backup server, if everything goes ok in production.
For now, thank you