How to log if a user removes a file from samba share
Solution 1
Thank you Bert Neef for trying to answer the question. But with or without the above lines in the smb.conf file, I found the a line in the log file with the client's hostname as below:
reply_unlink : file1
when I deleted the file1. This is observed by doing many trails. So, this log entry in the samab log files may help us to know if the user deletes a file from the samba shares by connecting from the samba clients.
Solution 2
It seems like the vfs_full_audit feature should get you the required info:
Based on instructions found here I think you should get it to work like this, Add the following to smb.conf and restart Samba:
vfs objects = full_audit
full_audit:prefix = %u|%I|%m|%S
full_audit:success = unlink open
full_audit:failure = none
full_audit:priority = NOTICE
Related videos on Youtube
Shashikanth Komandoor
Updated on September 18, 2022Comments
-
Shashikanth Komandoor almost 2 years
I am working over the default Samba that comes with RHEL 6.x version. I am successful in sharing a samba share to my client users.
I have given each of them a set of credentials using which they have to connect to samba server and upload or download their files.
I am able to log the details like which is file is found in the samba share at a point of time in the file like samba.log.server but it is not so clear that which user uploaded which file or which user downloaded which file.
Moreover I could not be able to log the details like when a file is removed from the samba share by which user.
Could anyone help me in getting or tracking the above required details?