This walkthrough applies to CentOS-based environments.

The full_audit Samba Virtual File System (VFS) module extends native Samba logging by capturing granular shared resource operasions with contextual metadata, enabling post-incident investigation for security and compliance.

Key capabilities of full_audit include:

• Tracking all configured file/directory actions (creation, deletion, modification, etc.)
• Attaching prefixed metadata to logs: user, client IP, client NetBIOS name, and active share

Step 1: Adjust Samba Configuration

full_audit can be enabled globally for all shares or scoped to individual directories.

Global Scope (all shares)

Insert the following within the [global] section of /etc/samba/smb.conf:

Share-Specific Scope (individual directories)

Add the configuration directly under the target share’s section (e.g., [public_data]).

   vfs objects = full_audit
   full_audit:prefix = %u@%I|%m|%S
   full_audit:success = connect disconnect mkdir rmdir open pread pwrite write rename unlink chmod chown
   full_audit:failure = none
   full_audit:facility = LOCAL7
   full_audit:priority = NOTICE

Configuration Parameter Breakdown

• vfs objects = full_audit: Activates the audit VFS layer to intercept operations
• full_audit:prefix: Defines log metadata, here structured as user@client_ip|client_hostname|share_name using Samba variable macros:
  • %u: Authenticated Samba username
  • %I: Raw client IPv4/IPv6 address
  • %m: Client NetBIOS hostname
  • %S: Active share name
• full_audit:success: Lists successful operations to log
• full_audit:failure: Disables logging of failed operations by default; use all to track failures, or specific operations (e.g., open chmod)
• full_audit:facility = LOCAL7: Routes logs to the LOCAL7 syslog facility (reserved for custom/local app logs on Unix-like systems; alternatives include auth, daemon, LOCAL0-LOCAL6)
• full_audit:priority = NOTICE: Sets log severity to normal but notable events; alternatives range from debug (verbose debugging) to emerg (system-wide failure)

Optional Global Log Tuning

Add these lines to [global] for per-client Samba log isolation and size management:

[global]
	log file = /var/log/samba/client-%u-%I.log
	log level = 2
	max log size = 2048

• log file: Stores unique logs per user and client IP
• log level: Sets detail level (0 = errors only, 1 = errors/warnings, ≥2 = debugging)
• max log size: Caps log files at 2048KB (2MB) before rotation

Step 2: Restart Samba Services

Apply configuration changes by restarting the core Samba daemons:

sudo systemctl restart smb nmb

smbd handles file/directory operation logging, while nmbd manages NetBIOS name resolution and network browse logs.

Step 3: Configure Syslog Routing

Create or edit /etc/rsyslog.d/smb-audit.conf to route LOCAL7.NOTICE logs to a dedicated audit file:

sudo vim /etc/rsyslog.d/smb-audit.conf

Add this line, replacing the path if needed:

local7.notice   /var/log/samba/smb-shared-audit.log

Restart the syslog daemon to activate routing:

sudo systemctl restart rsyslog

Step 4: Validate Auditing

Connect to the Samba share, perform test operations (create, edit, rename, delete files/directories, adjust permissions), then monitor the audit log:

sudo tail -f /var/log/samba/smb-shared-audit.log

Sample audit output:

Sep 22 09:15:42 centos-smb smbd_audit[12456]: admin@192.168.3.45|workstation01|team_docs|connect|ok
Sep 22 09:16:01 centos-smb smbd_audit[12456]: admin@192.168.3.45|workstation01|team_docs|mkdir|ok|/srv/samba/team_docs/quarterly_reports
Sep 22 09:16:27 centos-smb smbd_audit[12456]: admin@192.168.3.45|workstation01|team_docs|open|ok|/srv/samba/team_docs/quarterly_reports/Q3.xlsx
Sep 22 09:16:33 centos-smb smbd_audit[12456]: admin@192.168.3.45|workstation01|team_docs|rename|ok|/srv/samba/team_docs/quarterly_reports/Q3.xlsx|/srv/samba/team_docs/quarterly_reports/Q3~A1B2C3.tmp
Sep 22 09:16:33 centos-smb smbd_audit[12456]: admin@192.168.3.45|workstation01|team_docs|rename|ok|/srv/samba/team_docs/quarterly_reports/~tmp172698939387654321.TMP|/srv/samba/team_docs/quarterly_reports/Q3.xlsx
Sep 22 09:16:33 centos-smb smbd_audit[12456]: admin@192.168.3.45|workstation01|team_docs|unlink|ok|/srv/samba/team_docs/quarterly_reports/Q3~A1B2C3.tmp
Sep 22 09:17:12 centos-smb smbd_audit[12456]: admin@192.168.3.45|workstation01|team_docs|disconnect|ok

Editor-specific behavior may vary; for example, spreadsheet edits often appear as multiple rename/unlink operations due to atomic saving workflows.

Audit Log Field Breakdown

• centos-smb: Server hostname
• admin: Authenticated Samba user
• 192.168.3.45: Client IP address
• workstation01: Client NetBIOS hostname
• team_docs: Active share name
• connect, mkdir, rename: Operation type
• ok: Operation status
• /srv/samba/...: Target file/directory path(s)

Note that this does not require the separate Linux auditd framework, as full_audit operates natively within Samba.