Bug 13701 - vfs_audit en vfs_full_audit can only log to syslog
Summary: vfs_audit en vfs_full_audit can only log to syslog
Status: RESOLVED FIXED
Alias: None
Product: Samba 4.1 and newer
Classification: Unclassified
Component: VFS Modules (show other bugs)
Version: unspecified
Hardware: All All
: P5 enhancement (vote)
Target Milestone: ---
Assignee: Samba QA Contact
QA Contact: Samba QA Contact
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2018-12-04 06:40 UTC by Jorge Schrauwen
Modified: 2019-02-19 12:37 UTC (History)
0 users

See Also:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Jorge Schrauwen 2018-12-04 06:40:20 UTC 
It looks like vfs_audit and vfs_full_audit can only log to syslog.

On systems were journald is running it also keeps those entries in its ring-buffer. There is no way to disable this (you can only disable storing those entries to disk but that takes a big hammer). 

It would be desirable to also allow logging to a file like we can with the normal 'log file' command.
Comment 1 Jorge Schrauwen 2019-02-19 10:32:58 UTC 
I think this got fixed? Or atleast there is a patch for this at Sernet.
Comment 2 Ralph Böhme 2019-02-19 12:37:29 UTC 
Yes, this will be support with Samba 4.10 onwards, eg:

  log level = 1 full_audit:1@/var/log/audit.log