[Linux] Samba server 使用 full_audit 追蹤操作記錄

來源: http://jamyy.dyndns.org/blog/2011/05/3071.html

vi /etc/samba/smb.conf

vfs objects = full_audit
full_audit:facility = LOCAL6
full_audit:priority = NOTICE
full_audit:prefix = %u|%I|%m|%S
full_audit:success = rename mkdir rmdir unlink pwrite
full_audit:failure = none

vi /etc/syslog.conf

# 加上 local6.none 避免另外寫入一份到 /var/log/messages
*.info;mail.none;authpriv.none;cron.none;local6.none    /var/log/messages

# 將 full_audit 寫入指定檔案
local6.*                            /var/log/samba/full_audit.log

service syslog restart
service smb restart