From 38fe888f95f8d22736080ed521939be932e7bca0 Mon Sep 17 00:00:00 2001 From: Andrew Bartlett Date: Fri, 16 Apr 2021 10:43:07 +1200 Subject: [PATCH] docs: Expand the "log level" docs on audit logging BUG: https://bugzilla.samba.org/show_bug.cgi?id=14689 Signed-off-by: Andrew Bartlett Reviewed-by: Andreas Schneider --- docs-xml/smbdotconf/logging/loglevel.xml | 38 ++++++++++++++++++++---- 1 file changed, 33 insertions(+), 5 deletions(-) diff --git a/docs-xml/smbdotconf/logging/loglevel.xml b/docs-xml/smbdotconf/logging/loglevel.xml index 6ee9cdceb87..4c6bb5e7e73 100644 --- a/docs-xml/smbdotconf/logging/loglevel.xml +++ b/docs-xml/smbdotconf/logging/loglevel.xml @@ -84,25 +84,53 @@ 5: Anonymous Authentication and Authorization Success - Changes to the sam.ldb + Changes to the AD DC sam.ldb database are logged under the dsdb_audit and a JSON representation is logged under dsdb_json_audit. - Group membership changes to the Group membership changes to the AD DC sam.ldb database are logged under the dsdb_group_audit and a JSON representation is logged under dsdb_group_json_audit. - Password changes and Password resets are logged under - dsdb_password_audit and a JSON representation is logged under the - dsdb_password_json_audit. + Log levels for dsdb_audit, + dsdb_json_audit, + dsdb_group_audit, + dsdb_group_json_audit and + dsdb_json_audit are: + + 5: Database modifications + 5: Replicated updates from another DC + + + Password changes and Password resets in the AD DC are logged + under dsdb_password_audit and a JSON + representation is logged under the + dsdb_password_json_audit. Password changes + will also appears as authentication events via + auth_audit and + auth_audit_json. + + Log levels for dsdb_password_audit and + dsdb_password_json_audit are: + + 5: Successful password changes and resets + Transaction rollbacks and prepare commit failures are logged under the dsdb_transaction_audit and a JSON representation is logged under the dsdb_transaction_json_audit. + Log levels for dsdb_transaction_audit and + dsdb_transaction_json are: + + + 5: Transaction failure (rollback) + 10: Transaction success (commit) + + Transaction roll-backs are possible in Samba, and whilst they rarely reflect anything more than the failure of an individual operation (say due to the add of a conflicting record), -- 2.47.3