| View previous topic :: View next topic |
| Author |
Message |
Onion Avenger
Apprentice
Joined: 23 Apr 2003
Posts: 164
Location: New England
|
 Posted: Wed Dec 17, 2003 4:27 am Post subject: How to log files uploaded in Samba? |
 |
|
Hi,
I was browsing through my samba logs because I noticed that a computer(s) has been uploading some virii to my public share, such as the W32.HLLW.Kazmor.C worm.
Well, I'd like to track down which computer did this so I can notify the owner of his virus trouble but I have many logs for 30+ computers in my /var/log/samba directory.
I perused through the logs, but it doesn't seem to log which files were opened or written to. Smaba's documentation yielded nothing that I could find.
My smb.conf contains
| Code: | log file = /var/log/samba/log.%m
max log size = 50
log level = 3
|
Any ideas?
Thanks,
--Richie, the Onion Avenger |
|
| Back to top |
|
 |
Onion Avenger
Apprentice
Joined: 23 Apr 2003
Posts: 164
Location: New England
|
| Posted: Thu Dec 18, 2003 12:47 am Post subject: |
|
|
(bump)
anyone? |
|
| Back to top |
|
|
Chris W
l33t
Joined: 25 Jun 2002
Posts: 972
Location: Brisbane, Australia
|
| Posted: Thu Dec 18, 2003 1:49 am Post subject: |
|
|
Only suggestion is to try a higher debug level. I wouldn't leave it running like that for an indefinite period but it should be fine for finding the culprit.
Edit: Get some reasonable AV software on the 30+ boxen and this problem will also be diminished.
_________________
Cheers,
Chris W
"Common sense: The collection of prejudices acquired by age 18." -- Einstein |
|
| Back to top |
|
|
Onion Avenger
Apprentice
Joined: 23 Apr 2003
Posts: 164
Location: New England
|
| Posted: Thu Dec 18, 2003 1:59 am Post subject: |
|
|
| Chris W wrote: | Only suggestion is to try a higher debug level. I wouldn't leave it running like that for an indefinite period but it should be fine for finding the culprit.
|
Ah, okay. I'll try setting it to max temporarily and then try transferring files from other boxen to mine and see what gets logged.
| Chris W wrote: |
Edit: Get some reasonable AV software on the 30+ boxen and this problem will also be diminished. |
Ah, well I don't really have control over those boxen - it's a university dormitory.
Thanks for the reply,
--Richie, the Onion Avenger |
|
| Back to top |
|
|
Chris W
l33t
Joined: 25 Jun 2002
Posts: 972
Location: Brisbane, Australia
|
| Posted: Fri Dec 19, 2003 1:30 am Post subject: |
|
|
Is the Samba host yours? If so, how does a "No-AV, no connect policy sound"?
_________________
Cheers,
Chris W
"Common sense: The collection of prejudices acquired by age 18." -- Einstein |
|
| Back to top |
|
|
|
Networking & Security
