How to log if a user removes a file from samba share

Question

I am working over the default Samba that comes with RHEL 6.x version. I am successful in sharing a samba share to my client users.

I have given each of them a set of credentials using which they have to connect to samba server and upload or download their files.

I am able to log the details like which is file is found in the samba share at a point of time in the file like samba.log.server but it is not so clear that which user uploaded which file or which user downloaded which file.

Moreover I could not be able to log the details like when a file is removed from the samba share by which user.

Could anyone help me in getting or tracking the above required details?

Answer 1

It seems like the vfs_full_audit feature should get you the required info:

Based on instructions found here I think you should get it to work like this, Add the following to smb.conf and restart Samba:

vfs objects = full_audit
full_audit:prefix = %u|%I|%m|%S
full_audit:success = unlink open 
full_audit:failure = none
full_audit:priority = NOTICE

Answer 2

Thank you Bert Neef for trying to answer the question. But with or without the above lines in the smb.conf file, I found the a line in the log file with the client's hostname as below:

reply_unlink : file1

when I deleted the file1. This is observed by doing many trails. So, this log entry in the samab log files may help us to know if the user deletes a file from the samba shares by connecting from the samba clients.