Monitoring Samba Activity with Full_Audit

Question

I have samba server. I've configured smb.conf like this:

[global]
# Another configuration
#
#

# Audit Activity Settings
full_audit:prefix = %u|%I|%m|%S
full_audit:success = mkdir rename unlink rmdir pwrite pread
full_audit:failure = none
full_audit:facility = local7
full_audit:priority = NOTICE

[shared]
comment = Shared Content 
path = /data/shared
read only = no
browsable = yes
vfs objects = full_audit

I want to throw samba log to specific file, for example to /var/log/samba/log.audit. I've configured in rsyslog.conf like this:

if $syslogfacility-text == 'local7' and $programname == 'smbd' then /var/log/samba/log.audit

but nothing happen, no file log log.audit at /var/log/samba/.

And I have too try configured at /etc/rsyslog.d/50-default.conf like this:

local7.* /var/log/samba/log.audit

but same, no file log log.audit at /var/log/samba/.

But, Full_Audit logs available at syslog:

Mar 20 02:49:26 media-arsip smbd_audit: content|192.168.84.69|ubspok18|shared|mkdir|ok|sharedcontent/ok/tes

How to throw that syslog samba full_audit logs to /var/log/samba/log.audit ?

Answer 1

Perhaps you have resolved this already, however for posterity if so:

The resolution that worked in my case when I ran into both of these issues (on a CentOS 7 samba server) was two-fold.

Firstly: when vfs full_audit was configured with the local7 context, log entries were getting sent on to boot.log, which was already configured for that context. Defining a new context in smb.conf full_audit:facility = local5 and /etc/rsyslog.conf local5.* /var/log/smb_audit.log sent audit log messages to the chosen log file (in my case, /var/log/smb_audit.log).

Secondly: After the above configuration, log messages were sent to both my defined log file and syslog. This was because the local5 needed to be disabled for syslog in /etc/rsyslog.conf in order for syslog to not slurp them up as well as a default behaviour. This was accomplished by adding local5.none to my configuration line for /var/log/messages, so it ends up something like: *.info;mail.none;authpriv.none;cron.none;local5.none /var/log/messages.

(smbcontrol all reload-config && systemctl restart systemd-journald && systemctl restart rsyslog for these updates to take effect. Journald does not need to be restarted unless you are also choosing to increase your log limit/rate window, though for a reasonably heavily trafficked server, this may be desirable.)