smb_traffic_analyzer
8
Samba
System Administration tools
3.3
vfs_smb_traffic_analyzer
log Samba VFS read and write operations through a socket
to a helper application
vfs objects = smb_traffic_analyzer
DESCRIPTION
This VFS module is part of the
samba
7 suite.
The vfs_smb_traffic_analyzer VFS module logs
client write and read operations on a Samba server and sends this data
over a socket to a helper program, which feeds a SQL database. More
information on the helper programs can be obtained from the
homepage of the project at:
http://holger123.wordpress.com/smb-traffic-analyzer/
vfs_smb_traffic_analyzer currently is aware
of the following VFS operations:
write
pwrite
read
pread
vfs_smb_traffic_analyzer sends the following data
in a fixed format seperated by a comma through either an internet or a
unix domain socket:
BYTES|USER|DOMAIN|READ/WRITE|SHARE|FILENAME|TIMESTAMP
Description of the records:
BYTES - the length in bytes of the VFS operation
USER - the user who initiated the operation
DOMAIN - the domain of the user
READ/WRITE - either "W" for a write operation or "R" for read
SHARE - the name of the share on which the VFS operation occured
FILENAME - the name of the file that was used by the VFS operation
TIMESTAMP - a timestamp, formatted as "yyyy-mm-dd hh-mm-ss.ms" indicating when the VFS operation occured
This module is stackable.
OPTIONS
smb_traffic_analyzer:mode = STRING
If STRING matches to "unix_domain_socket", the module will
use a unix domain socket located at /var/tmp/stadsocket, if
STRING contains an different string or is not defined, the module will
use an internet domain socket for data transfer.
smb_traffic_analyzer:host = STRING
The module will send the data to the system named with
the hostname STRING.
smb_traffic_analyzer:port = STRING
The module will send the data using the TCP port given
in STRING.
smb_traffic_analyzer:anonymize_prefix = STRING
The module will replace the user names with a prefix
given by STRING and a simple hash number.
EXAMPLES
The module running on share "example_share", using a unix domain socket
/data/example
smb_traffic_analyzer
unix_domain_socket
The module running on share "example_share", using an internet domain socket,
connecting to host "examplehost" on port 3491.
/data/example
smb_traffic_analyzer
examplehost
3490
VERSION
This man page is correct for version 3.3 of the Samba suite.
AUTHOR
The original Samba software and related utilities
were created by Andrew Tridgell. Samba is now developed
by the Samba Team as an Open Source project similar
to the way the Linux kernel is developed.
The original version of the VFS module and the
helper tools were created by Holger Hetterich.