samba开启用户审计

1./etc/samba/smb.conf添加如下配置:

global：

[global]
	workgroup = SAMBA
	security = user

	passdb backend = tdbsam

	printing = cups
	printcap name = cups
	load printers = yes
	cups options = raw
	log file = /var/log/samba/%m.log
	log level = 5 vfs:10 # 定义日志级别
	vfs object = vfs
	vfs object = full_audit #开启审计
	full_audit:prefix = %u|%I|%S
	full_audit:failure = connect chdir #审计失败的动作
	full_audit:success = mkdir rmdir rename unlink pwrite_send pwrite_recv pread_recv pread_send  #审计成功的动作
	#full_audit:success =     mkdir rmdir rename unlink pwrite pread sendfile recvfile
	full_audit:facility = local5 #审计日志保存位置设置
	full_audit:priority = notice #定义日志级别

共享目录：

[share]
	comment = share
	path = /home/share
	public = no
	writable = yes
	vfs object = vfs
	vfs object = full_audit #该目录开启审计

2.日志输出设置：/etc/rsyslog.conf