Getting Error Message when trying to access Log from SMB/Cifs

epicfail · 14. Juni 2017

Hi!

I´m getting the following error message when trying to access the log for SMB/Cifs.
I´m on the newest OMV 3 release with all updates and latest backport kernel.

Code

Failed to execute command 'export PATH=/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin; export LANG=C; export SYSTEMD_COLORS=0; journalctl --quiet --no-pager --priority='notice' SYSLOG_FACILITY=23 SYSLOG_IDENTIFIER='smbd_audit' --output=short 1>/tmp/logfilenwh4v6 2>&1' with exit code '1':

Details:

Code

Fehler #0:
exception 'OMV\ExecException' with message 'Failed to execute command 'export PATH=/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin; export LANG=C; export SYSTEMD_COLORS=0; journalctl --quiet --no-pager --priority='notice' SYSLOG_FACILITY=23 SYSLOG_IDENTIFIER='smbd_audit' --output=short 1>/tmp/logfilenwh4v6 2>&1' with exit code '1': ' in /usr/share/php/openmediavault/system/process.inc:175
Stack trace:
#0 /usr/share/openmediavault/engined/rpc/logfile.inc(73): OMV\System\Process->execute()
#1 [internal function]: OMVRpcServiceLogFile->getList(Array, Array)
#2 /usr/share/php/openmediavault/rpc/serviceabstract.inc(124): call_user_func_array(Array, Array)
#3 /usr/share/php/openmediavault/rpc/rpc.inc(86): OMV\Rpc\ServiceAbstract->callMethod('getList', Array, Array)
#4 /usr/sbin/omv-engined(536): OMV\Rpc\Rpc::call('LogFile', 'getList', Array, Array, 1)
#5 {main}

Any ideas what this means and how can i fix it?

votdev · 14. Juni 2017

This is displayed because there are no SMB audit logs. Please search the forum for other posts about this topic.

epicfail · 14. Juni 2017

So this message should only pop up if the log level is set to none...am i right?

I´ve set it to Full and then to Debug....restarted the NAS...but the error message repeats

votdev · 14. Juni 2017

In this case SMB does not log anything. Maybe this needs some investigation.

peekaa · 14. Juni 2017

same with me.. log
There might be error in the SYSLOG_IDENTIFIER='smbd_audit', theremight be no more nothing like smbd_audit....

Thank you.

votdev · 14. Juni 2017

I can not reproduce this, everything works fine out-of-the-box. Maybe the journalctl command is different on your systems. What hardware and OS (Debian origin, Raspbian, ...) are you using?

Are you sure that there exist any SMB audit log messages?

Bash

# cat /var/log/syslog | grep smbd_audit

peekaa · 14. Juni 2017

Code

root@box:~# cat /var/log/syslog | grep smbd_audit
root@box:~#

There are any smbd_audit messages.... Using Debian, its 1/2 year old clean omv 3.0 instalation.

Code

#======================= Global Settings =======================
[global]
workgroup = HOMELAN
server string = wood
dns proxy = no
log level = 2
syslog = 2
log file = /var/log/samba/log.%m
max log size = 1000
syslog only = yes
panic action = /usr/share/samba/panic-action %d
encrypt passwords = true
passdb backend = tdbsam
obey pam restrictions = no
unix password sync = no
passwd program = /usr/bin/passwd %u
passwd chat = *Enter\snew\s*\spassword:* %n\n *Retype\snew\s*\spassword:* %n\n *password\supdated\ssuccessfully* .
pam password change = yes
socket options = TCP_NODELAY IPTOS_LOWDELAY
guest account = nobody
load printers = no
disable spoolss = yes
printing = bsd
printcap name = /dev/null
unix extensions = yes
wide links = no
create mask = 0777
directory mask = 0777
use sendfile = yes
aio read size = 16384
aio write size = 16384
null passwords = no
local master = yes
time server = yes
wins support = yes
acl allow execute always = yes
preferred master = yes
#domain master = yes

Alles anzeigen

votdev · 14. Juni 2017

There are no shared folders in the smb.conf. You know that the audit log is and how it works? If you have no shares, then you can not copy/move/delete files there which will produce audit log entries.

peekaa · 14. Juni 2017

Yes, there are. I just did not know how to copy all the file into clipboard with putty. Here it is all:

votdev · 14. Juni 2017

None of your shares are enabled to audit file operations. You need to check the 'Audit' checkbox in the SMB share dialog.

peekaa · 14. Juni 2017

I see, thank you.

Jetzt mitmachen!