Save audit samba audit logs in seperate files

kselltrum · Dec 3rd 2020

Is it possible in the system to write audit logs in separate files that can be exported in a script to the ftp statistics server.

I can see audit log records only in syslog, but files in sabma logs have 0 size.

Best Regards, Evhenii

votdev · Dec 3rd 2020

No, there is no way to write the audit logs to a seperate file, but you can use journalctl to export the data manually, e.g. by running a cron job.

journalctl --quiet --no-pager --priority='notice' --identifier='smbd_audit' --output=short

kselltrum · Dec 4th 2020

Thanks.

I solve this another way.

I add this line in /etc/rsyslog.conf

Bash

local7.notice -/var/log/samba/log.audit

And export daily files in ftp server by cron.

After export i clean log.audit

Bash

truncate /var/log/samba/log.audit --size 0

Best Regards, Evhenii

votdev Dec 4th 2020