From 44e419b8c49662f3563b0344cb94192913121649 Mon Sep 17 00:00:00 2001 From: James Peach Date: Wed, 28 Feb 2007 22:46:31 +0000 Subject: [PATCH] Document the full_audit VFS module. --- docs/manpages-3/smb-vfs-full_audit.8.xml | 262 +++++++++++++++++++++++ 1 file changed, 262 insertions(+) create mode 100644 docs/manpages-3/smb-vfs-full_audit.8.xml diff --git a/docs/manpages-3/smb-vfs-full_audit.8.xml b/docs/manpages-3/smb-vfs-full_audit.8.xml new file mode 100644 index 00000000000..656f36e9cb8 --- /dev/null +++ b/docs/manpages-3/smb-vfs-full_audit.8.xml @@ -0,0 +1,262 @@ + + + + + + vfs_full_audit + 8 + + + + + vfs_full_audit + record Samba VFS operations in the system log + + + + + vfs objects = full_audit + + + + + DESCRIPTION + + This VFS module is part of the + samba + 7 suite. + + The vfs_full_audit VFS module records selected + client operations to the system log using + syslog + 3. + + vfs_full_audit is able to record the + complete set of Samba VFS operations: + + + connect + disconnect + disk_free + get_quota + set_quota + get_shadow_copy_data + statvfs + opendir + readdir + seekdir + telldir + rewinddir + mkdir + rmdir + closedir + open + close + read + pread + write + pwrite + lseek + sendfile + rename + fsync + stat + fstat + lstat + unlink + chmod + fchmod + chown + fchown + chdir + getwd + utime + ftruncate + lock + kernel_flock + linux_setlease + getlock + symlink + readlink + link + mknod + realpath + fget_nt_acl + get_nt_acl + fset_nt_acl + set_nt_acl + chmod_acl + fchmod_acl + sys_acl_get_entry + sys_acl_get_tag_type + sys_acl_get_permset + sys_acl_get_qualifier + sys_acl_get_file + sys_acl_get_fd + sys_acl_clear_perms + sys_acl_add_perm + sys_acl_to_text + sys_acl_init + sys_acl_create_entry + sys_acl_set_tag_type + sys_acl_set_qualifier + sys_acl_set_permset + sys_acl_valid + sys_acl_set_file + sys_acl_set_fd + sys_acl_delete_def_file + sys_acl_get_perm + sys_acl_free_text + sys_acl_free_acl + sys_acl_free_qualifier + getxattr + lgetxattr + fgetxattr + listxattr + llistxattr + flistxattr + removexattr + lremovexattr + fremovexattr + setxattr + lsetxattr + fsetxattr + aio_read + aio_write + aio_return + aio_cancel + aio_error + aio_fsync + aio_suspend + + + In addition to these operations, + vfs_full_audit recognizes the special operation + names "all" and "none ", which refer to all + the VFS operations and none of the VFS operations respectively. + + + vfs_full_audit records operations in fixed + format consisting of fields separated by '|' characters. The + format is: + + smbd_audit: PREFIX|OPERATION|RESULT|FILE + + + The record fields are: + + + PREFIX - the result of the full_audit:prefix string after variable substitutions + OPERATION - the name of the VFS operation + RESULT - whether the operation succeeded or failed + FILE - the name of the file or directory the operation was performed on + + + + This module is stackable. + + + + + + OPTIONS + + + + + vfs_full_audit:prefix = STRING + + Prepend audit messages with STRING. STRING is + processed for standard substitution variables listed in + smb.conf + 5. The default + prefix is "%u|%I". + + + + + + vfs_full_audit:success = LIST + + LIST is a list of VFS operations that should be + recorded if they succeed. Operations are specified using + the names listed above. + + + + + + + vfs_full_audit:failure = LIST + + LIST is a list of VFS operations that should be + recorded if they failed. Operations are specified using + the names listed above. + + + + + + + full_audit:facility = FACILITY + + Log messages to the named + syslog + 3 facility. + + + + + + + + full_audit:priority = PRIORITY + + Log messages with the named + syslog + 3 priority. + + + + + + + + + + EXAMPLES + + Log file and directory open operations on the [records] + share using the LOCAL7 facility and ALERT priority, including + the username and IP address: + + + + /data/records + full_audit + %u|%I + open opendir + all + LOCAL7 + ALERT + + + + + + VERSION + This man page is correct for version 3.0.25 of the Samba suite. + + + + + AUTHOR + + The original Samba software and related utilities + were created by Andrew Tridgell. Samba is now developed + by the Samba Team as an Open Source project similar + to the way the Linux kernel is developed. + + + +