summaryrefslogtreecommitdiffstats
path: root/docs-xml/Samba-EventLog-HOWTO.txt
diff options
context:
space:
mode:
Diffstat (limited to 'docs-xml/Samba-EventLog-HOWTO.txt')
-rw-r--r--docs-xml/Samba-EventLog-HOWTO.txt130
1 files changed, 130 insertions, 0 deletions
diff --git a/docs-xml/Samba-EventLog-HOWTO.txt b/docs-xml/Samba-EventLog-HOWTO.txt
new file mode 100644
index 0000000..33b3c1d
--- /dev/null
+++ b/docs-xml/Samba-EventLog-HOWTO.txt
@@ -0,0 +1,130 @@
+##
+## Samba-EventLog-HOWTO.txt
+## Brian Moran <bmoran@centeris.com>
+##
+## Feature Introduced in Samba 3.0.21
+##
+
+Samba and Eventlogs
+===================
+
+Samba servers now support event logs -- this means that if
+Samba is configured correctly, the usual administration tools
+like event viewer will work against a Samba server.
+
+To minimally configure Samba to publish event logs, the
+eventlogs to list must be specified in smb.conf, and
+eventlog entries must be written to those eventlogs.
+
+Optionally, a message file can be registered for each
+of the eventlog 'sources' to pretty-print the eventlog
+messages in the eventlog viewer.
+
+Configuring smb.conf
+====================
+
+To specify the list of eventlogs the eventlog list
+command is used. An example which will show four
+eventlogs is
+
+ eventlog list = Application System Security SyslogLinux
+
+When Samba initially starts, it looks to see if the
+eventlog directory, and a particular log exists; if not,
+the directory and file are created under LOCK_DIR
+
+Writing EventLog Records
+========================
+
+The eventlogadm command is used to write records
+into a particular eventlog. Eventlogadm expects records
+to be on STDIN in the following format
+
+ LEN: 0
+ RS1: 1699505740
+ RCN: 0
+ TMG: 1128631322
+ TMW: 1128631322
+ EID: 1000
+ ETP: INFO
+ ECT: 0
+ RS2: 0
+ CRN: 0
+ USL: 0
+ SRC: cron
+ SRN: dmlinux
+ STR: (root) CMD ( rm -f /var/spool/cron/lastrun/cron.hourly)
+ DAT:
+
+These fields closely mirror the eventlog structures
+used by the APIs. The definitions of the fields are
+
+- LEN: <integer> The length field is calculated by the
+ eventlogadm program based on the rest of the information
+ in the record. Zero works well here.
+- RS1: 1699505740 A "magic number", the primary purpose of
+ which seems to be to be able to find eventlog records in a
+ sea of binary data
+- TMG: <integer> The time the eventlog record was generated;
+ format is the number of seconds since 00:00:00 January 1,
+ 1970, UTC
+- TMW: <integer> The time the eventlog record was written;
+ format is the number of seconds since 00:00:00 January 1,
+ 1970, UTC
+- EID: <integer> The eventlog ID -- used as a index to a
+ message string in a message DLSamba and Eventlogs
+- ETP: <string> The event type -- one of INFO, ERROR,
+ WARNING, AUDIT SUCCESS, AUDIT FAILURE
+- ECT: <integer> The event category; this depends on the
+ message file -- primarily used as a means of filtering in
+ the eventlog viewer
+- RS2: 0 Another reserved field
+- CRN: 0 Yet another reserved field
+- USL: <integer> Typically would contain the length of the
+ SID of the user object associated with this event. This is
+ not supported now, so leave this zero.
+- SRC: <string> The source name associated with the event
+ log, e.g. "cron" or "smbd". If a message file is used with an
+ event log, there will be a registry entry for associating
+ this source name with a message file DLL
+- SRN: <string> The name of the machine on which the
+ eventlog was generated. This is typically the host name
+- STR: <string> The text associated with the eventlog. Note
+ that there may be more than one strings in a record
+- DAT: <string> Eventlog records can have binary information
+ associated with them. DAT only supports ASCII strings however
+
+Typically, one would set up a program to gather events, format
+them into records, and pipe them into eventlogadm for a
+particular eventlog:
+
+# tail -f /var/log/messages |\
+ my_program_to_parse_into_eventlog_records |\
+ eventlogadm SyslogLinux
+
+Note that individual records are separated on the input by one
+or more blank lines. In this manner, eventlogadm will just wait
+for more input, writing to the underlying log files as necessary.
+
+
+Deciphering EventLog entries on the Client
+==========================================
+
+To set up an eventlog source (which is used by the eventlog viewer
+program to pretty-print eventlog records), create a message file
+DLL, then use the eventlogadm program to write the appropriate
+eventlog registry entries:
+
+# eventlogadm -o addsource Application MyApplication \
+ %SystemRoot%/system32/MyApplication.dll
+
+This will add the key
+[HKLM/System/CurrentControlSet/services/Eventlog/Application/MyApplication]
+and to that key add value "MyApplication/EventLogMessageFile"
+with a string of %SystemRoot%/system32/MyApplication.dll
+
+If there happens to be a share called [C$] on your samba server,
+and in that share there's a Windows/system32/MyApplication.dll
+file, it will be read by the eventlog viewer application when
+displaying eventlog records to pretty-print your eventlog entries.
+