Linux – How to log if a user removes a file from samba share

linuxrhel6sambasamba4

I am working over the default Samba that comes with RHEL 6.x version. I am successful in sharing a samba share to my client users.

I have given each of them a set of credentials using which they have to connect to samba server and upload or download their files.

I am able to log the details like which is file is found in the samba share at a point of time in the file like samba.log.server but it is not so clear that which user uploaded which file or which user downloaded which file.

Moreover I could not be able to log the details like when a file is removed from the samba share by which user.

Could anyone help me in getting or tracking the above required details?

Best Answer

It seems like the vfs_full_audit feature should get you the required info:

Based on instructions found here I think you should get it to work like this, Add the following to smb.conf and restart Samba:

vfs objects = full_audit
full_audit:prefix = %u|%I|%m|%S
full_audit:success = unlink open 
full_audit:failure = none
full_audit:priority = NOTICE
Related Topic