This document is a Mac OS X manual page. Manual pages are a command-line technology for providing documentation. You can view these manual pages locally using the man(1) command. These manual pages come from many different sources, and thus, have a variety of writing styles.

For more information about the manual page format, see the manual page for manpages(5).

VFS_FULL_AUDIT(8)                                                                          VFS_FULL_AUDIT(8)



NAME
       vfs_full_audit - record Samba VFS operations in the system log

SYNOPSIS
       vfs objects = full_audit

DESCRIPTION
       This VFS module is part of the samba(7) suite.

       The vfs_full_audit VFS module records selected client operations to the system log using syslog(3).

       vfs_full_audit is able to record the complete set of Samba VFS operations:

          aio_cancel

          aio_error

          aio_fsync

          aio_read

          aio_return

          aio_suspend

          aio_write

          chdir

          chflags

          chmod

          chmod_acl

          chown

          close

          closedir

          connect

          disconnect

          disk_free

          fchmod

          fchmod_acl

          fchown

          fget_nt_acl

          fgetxattr

          flistxattr

          fremovexattr

          fset_nt_acl

          fsetxattr

          fstat

          fsync

          ftruncate

          get_nt_acl

          get_quota

          get_shadow_copy_data

          getlock

          getwd

          getxattr

          kernel_flock

          lgetxattr

          link

          linux_setlease

          listxattr

          llistxattr

          lock

          lremovexattr

          lseek

          lsetxattr

          lstat

          mkdir

          mknod

          open

          opendir

          pread

          pwrite

          read

          readdir

          readlink

          realpath

          removexattr

          rename

          rewinddir

          rmdir

          seekdir

          sendfile

          set_nt_acl

          set_quota

          setxattr

          stat

          statvfs

          symlink

          sys_acl_add_perm

          sys_acl_clear_perms

          sys_acl_create_entry

          sys_acl_delete_def_file

          sys_acl_free_acl

          sys_acl_free_qualifier

          sys_acl_free_text

          sys_acl_get_entry

          sys_acl_get_fd

          sys_acl_get_file

          sys_acl_get_perm

          sys_acl_get_permset

          sys_acl_get_qualifier

          sys_acl_get_tag_type

          sys_acl_init

          sys_acl_set_fd

          sys_acl_set_file

          sys_acl_set_permset

          sys_acl_set_qualifier

          sys_acl_set_tag_type

          sys_acl_to_text

          sys_acl_valid

          telldir

          unlink

          utime

          write

       In  addition  to  these  operations,  vfs_full_audit recognizes the special operation names "all" and
       "none ", which refer to all the VFS operations and none of the VFS operations respectively.

       vfs_full_audit records operations in fixed format consisting of fields separated by  '|'  characters.
       The format is:


                 smbd_audit: PREFIX|OPERATION|RESULT|FILE


       The record fields are:

         PREFIX - the result of the full_audit:prefix string after variable substitutions

         OPERATION - the name of the VFS operation

         RESULT - whether the operation succeeded or failed

         FILE - the name of the file or directory the operation was performed on

       This module is stackable.

OPTIONS
       vfs_full_audit:prefix = STRING
          Prepend audit messages with STRING. STRING is processed for standard substitution variables listed
          in smb.conf(5). The default prefix is "%u|%I".

       vfs_full_audit:success = LIST
          LIST is a list of VFS operations that should be recorded if they succeed. Operations are specified
          using the names listed above.

       vfs_full_audit:failure = LIST
          LIST  is a list of VFS operations that should be recorded if they failed. Operations are specified
          using the names listed above.

       full_audit:facility = FACILITY
          Log messages to the named syslog(3) facility.

       full_audit:priority = PRIORITY
          Log messages with the named syslog(3) priority.

EXAMPLES
       Log file and directory open operations on the [records] share using the  LOCAL7  facility  and  ALERT
       priority, including the username and IP address:


               [records]
            path = /data/records
            vfs objects = full_audit
            full_audit:prefix = %u|%I
            full_audit:success = open opendir
            full_audit:failure = all
            full_audit:facility = LOCAL7
            full_audit:priority = ALERT


VERSION
       This man page is correct for version 3.0.25 of the Samba suite.

AUTHOR
       The  original  Samba  software  and  related  utilities were created by Andrew Tridgell. Samba is now
       developed by the Samba Team as an Open Source project similar to the way the Linux kernel  is  devel-oped. developed.
       oped.




                                                                                           VFS_FULL_AUDIT(8)