Linux Certif

Toute la documentation sur la certification Linux LPI

vfs_smb_traffic_analyzer

vfs_smb_traffic_analyzer - log Samba VFS read and write operations through a socket to a helper application

Synopsis

FCvfs objects = smb_traffic_analyzerF[]

DESCRIPTION

This VFS module is part of the samba(7) suite.

The FCvfs_smb_traffic_analyzerF[] VFS module logs client write and read operations on a Samba server and sends this data over a socket to a helper program, which feeds a SQL database. More information on the helper programs can be obtained from the homepage of the project at: http://holger123.wordpress.com/smb-traffic-analyzer/

FCvfs_smb_traffic_analyzerF[] currently is aware of the following VFS operations:

write

pwrite

read

pread

FCvfs_smb_traffic_analyzerF[] sends the following data in a fixed format seperated by a comma through either an internet or a unix domain socket:

 
 
         BYTES|USER|DOMAIN|READ/WRITE|SHARE|FILENAME|TIMESTAMP
         
 

Description of the records:

* FCBYTESF[] - the length in bytes of the VFS operation

* FCUSERF[] - the user who initiated the operation

* FCDOMAINF[] - the domain of the user

* FCREAD/WRITEF[] - either "W" for a write operation or "R" for read

* FCSHAREF[] - the name of the share on which the VFS operation occured

* FCFILENAMEF[] - the name of the file that was used by the VFS operation

* FCTIMESTAMPF[] - a timestamp, formatted as "yyyy-mm-dd hh-mm-ss.ms" indicating when the VFS operation occured

This module is stackable.  

OPTIONS

smb_traffic_analyzer:mode = STRING

If STRING matches to "unix_domain_socket", the module will use a unix domain socket located at /var/tmp/stadsocket, if STRING contains an different string or is not defined, the module will use an internet domain socket for data transfer.

smb_traffic_analyzer:host = STRING

The module will send the data to the system named with the hostname STRING.

smb_traffic_analyzer:port = STRING

The module will send the data using the TCP port given in STRING.

smb_traffic_analyzer:anonymize_prefix = STRING

The module will replace the user names with a prefix given by STRING and a simple hash number.

smb_traffic_analyzer:total_anonymization = STRING

If STRING matches to 'yes', the module will replace any user name with the string given by the option smb_traffic_analyzer:anonymize_prefix, without generating an additional hash number. This means that any transfer data will be mapped to a single user, leading to a total anonymization of user related data.

EXAMPLES

The module running on share "example_share", using a unix domain socket

 
 
         [example_share]
         m[blue]path = /data/examplem[]
         m[blue]vfs objects = smb_traffic_analyzerm[]
         m[blue]smb_traffic_analyzer:mode = unix_domain_socketm[]
         
 

The module running on share "example_share", using an internet socket, connecting to host "examplehost" on port 3491.

 
 
         [example_share]
         m[blue]path = /data/examplem[]
         m[blue]vfs objects = smb_traffic_analyzerm[]
         m[blue]smb_traffic_analyzer:host = examplehostm[]
         m[blue]smb_traffic_analyzer:port = 3491m[]
         
 

The module running on share "example_share", using an internet socket, connecting to host "examplehost" on port 3491, anonymizing user names with the prefix "User".

 
 
         [example_share]
         m[blue]path = /data/examplem[]
         m[blue]vfs objects = smb_traffic_analyzerm[]
         m[blue]smb_traffic_analyzer:host = examplehostm[]
         m[blue]smb_traffic_analyzer:port = 3491m[]
         m[blue]smb_traffic_analyzer:anonymize_prefix = Userm[]
         
 

 

VERSION

This man page is correct for version 3.3 of the Samba suite.

AUTHOR

The original Samba software and related utilities were created by Andrew Tridgell. Samba is now developed by the Samba Team as an Open Source project similar to the way the Linux kernel is developed.

The original version of the VFS module and the helper tools were created by Holger Hetterich.