Bug #2870: Smbaudit doesn't show the name of the file for some operations - NethServer 6 - NethServer.org

Bug #2870

Smbaudit doesn't show the name of the file for some operations

Added by Alessio Fattorini almost 7 years ago. Updated almost 7 years ago.

Status:

CLOSED

Start date:

Priority:

Normal

Due date:

Assignee:

% Done:

100%

Category:

nethserver-samba-audit

Target version:

v6.5

Security class:

Resolution:

Affected version:

v6.5-final

NEEDINFO:

Description

All actions of the "elimination" are registered but have no way of know which file was deleted.
Same thing for the renaming, I know only the name of the file renamed, but not the new name that has been assigned.
Moreover there are a lot of rows with a generic "other operation" action, which gives no information about the action indicated
See attachment for more info

Samba Audit.png (104 KB) Alessio Fattorini, 09/09/2014 06:53 AM

Associated revisions

Revision 7132b949
Added by Giacomo Sanchietti almost 7 years ago

Log parser: handle special cases. Refs #2870

Revision 30b1c007
Added by Giacomo Sanchietti almost 7 years ago

Log parser: fix rename action. Refs #2870

History

#1 Updated by Giacomo Sanchietti almost 7 years ago

Please attach the log.

#2 Updated by Giacomo Sanchietti almost 7 years ago

Status changed from NEW to TRIAGED
% Done changed from 0 to 20
Affected version set to v6.5-final

Extract from /var/log/smbaudit.log:

Sep 11 12:30:42 localhost smbd[26698]: smbauditlog|2014/09/11 12:30:42|giacomo|192.168.5.22|test|giacomo|open|ok|r|COPYING
Sep 11 12:30:46 localhost smbd[26698]: smbauditlog|2014/09/11 12:30:46|giacomo|192.168.5.22|test|giacomo|open|ok|w|Corso_Linux_Base.pdf
Sep 11 12:30:51 localhost smbd[26698]: smbauditlog|2014/09/11 12:30:51|giacomo|192.168.5.22|test|giacomo|rename|ok|Corso_Linux_Base.pdf|aaa.pdf
Sep 11 12:30:58 localhost smbd[26698]: smbauditlog|2014/09/11 12:30:58|giacomo|192.168.5.22|test|giacomo|unlink|ok|COPYING

Extract from MySQL table:

[root@localhost ~]# mysql smbaudit -e "select * from audit";
+----+---------------------+-------+--------------+---------+--------+--------+---------+
| id | when                | share | ip           | user    | op     | result | arg     |
+----+---------------------+-------+--------------+---------+--------+--------+---------+
|  1 | 2014-09-11 12:02:30 | test  | 192.168.5.22 | giacomo | open   | ok     | COPYING |
|  2 | 2014-09-11 12:02:51 | test  | 192.168.5.22 | giacomo | unlink | ok     | NULL    |
+----+---------------------+-------+--------------+---------+--------+--------+---------+

Not all parameters are reported inside the MySQL table: the bug is confirmed.