logging SMB connections

[Luke Jaeger]

Is there an easy way to log SMB connections on FreeNAS 11? I would like to see who is logging in and out, and when. Need to see user name, timestamp, and client IP / host. Basically, the info you'd get from smbstatus, but dumped to a log file.

Thanks!

 

[m0nkey_]

You need to add the vfs_audit to your SMB shares. You do this by going into Advanced and selecting vfs_audit.

http://doc.freenas.org/11/sharing.html#windows-smb-shares

https://www.samba.org/samba/docs/current/man-html/vfs_audit.8.html

 

[Luke Jaeger]

perfect, thanks!

 

[anodos]

vfs_audit is no longer needed to do this in Samba 4.7 (FN 11.1 ). Under services->SMB add the following aux parameter log level = 1 auth_audit:3

 

[m0nkey_]

vfs_audit is no longer needed to do this in Samba 4.7 (FN 11.1 ). Under services->SMB add the following aux parameter log level = 1 auth_audit:3

Maybe include that in the documentation? ;)

 

[Luke Jaeger]

vfs_audit is no longer needed to do this in Samba 4.7 (FN 11.1 ). Under services->SMB add the following aux parameter log level = 1 auth_audit:3

vfs_audit is no longer needed to do this in Samba 4.7 (FN 11.1 ). Under services->SMB add the following aux parameter log level = 1 auth_audit:3

Is there an advantage to doing it this way rather than vfs_audit?

 

[m0nkey_]

Is there an advantage to doing it this way rather than vfs_audit?

I can't see an advantage, other than not having to load another vfs object.

From what I can make out from the (somewhat lacking) documentation of this feature, it will only log successful and failed authentication & authorization attempts. While the VFS audit object will also log things like file creation, deletion, etc.

 

[anodos]

I can't see an advantage, other than not having to load another vfs object.

From what I can make out from the (somewhat lacking) documentation of this feature, it will only log successful and failed authentication & authorization attempts. While the VFS audit object will also log things like file creation, deletion, etc.

Right. Avoiding layering VFS objects can be useful. JSON support is nice as well.

 

[anodos]

I can't see an advantage, other than not having to load another vfs object.

From what I can make out from the (somewhat lacking) documentation of this feature, it will only log successful and failed authentication & authorization attempts. While the VFS audit object will also log things like file creation, deletion, etc.

You can also adjust log levels on the fly through smbcontrol. I'm looking forward to seeing more 4.7 in production because this feature can potentially make it easier to debug auth problems.