Koozali.org: home of the SME Server

Other Languages => Italiano => Topic started by: Spillo on February 20, 2019, 08:32:40 AM

Title: Log partizione samba
Post by: Spillo on February 20, 2019, 08:32:40 AM

Salve,

ultimamente ho avuto un po di cartelle cancellate sul server, recuperate dal bck mi farebbe comodo capire chi sia stato. Se non ricordo male in una installazione standard questa funzionalita non è attiva, si deve attivare qualche parametro per avere i log di chi cancella cartelle o file?
(auditing???)

P.S. ho trovato questo... https://wiki.contribs.org/Audit_Tools   farebbe al caso mio? qualcuno ha avuto modo di provarlo????

danghiù

Title: Re: Log partizione samba
Post by: mmccarn on February 20, 2019, 01:31:02 PM

Samba Audit logging can be enabled for ibays using a db variable.  For user samba shares you would need a custom template fragment.

Here is a forum post from last year about enabling samba audit logs for ibays:
https://forums.contribs.org/index.php/topic,53486.msg277770.html#msg277770

To enable audit logging for the ibay named "fileshare":

Code: [Select]

db accounts setprop fileshare Audit enabled
signal-event ibay-modify fileshare

To enable audit logging for every ibay on your server:

Code: [Select]

for ibay in $(db accounts show |grep \=ibay |cut -d= -f1); do db accounts setprop $ibay Audit enabled; done
signal-event ibay-modify

Samba activity is then logged in /var/log/samba/samba_audit

Title: Re: Log partizione samba
Post by: mmccarn on February 20, 2019, 01:53:22 PM

I have added some notes on this to the wiki:
https://wiki.contribs.org/Useful_Commands#enable_samba_audit_logs_for_ibays

Title: Re: Log partizione samba
Post by: Spillo on February 21, 2019, 11:20:35 AM

hi,

Ok, thank you for the info .... this weekend I'll try on a backup server, if everything goes ok in production.
For now, thank you