Contents
How do I access the event log?
Click Start > Control Panel > System and Security > Administrative Tools. Double-click Event Viewer. Select the type of logs that you wish to review (ex: Windows Logs)
What is an event ID?
Event identifiers uniquely identify a particular event. Each event source can define its own numbered events and the description strings to which they are mapped in its message file. Event viewers can present these strings to the user.
What is SAMBA and how it works?
Samba is an extremely useful networking tool for anyone who has both Windows and Unix systems on his network. Running on a Unix system, it allows Windows to share files and printers on the Unix host, and it also allows Unix users to access resources shared by Windows systems.
How are events logged on the Samba server?
Events are logged on the Samba server the event was performed on. To store all logs on a centralized server, set up a centralized syslog server, configure Samba to log to the syslog daemon, and configure the syslog daemon to send the logs to the centralized server. For details, see:
How to create a log file in samba?
For example, to create log files for each connecting host named NetBIOS_name .log in the /var/log/samba/ folder: Set the log file parameter in the [global] section in the smb.conf:
Who is responsible for logging on Samba DC?
The domain member logs an authorization event. The KDC on the Samba DC logs an authentication event when using Kerberos authentication. When using Kerberos authentication, the KDC is responsible for authentication. Therefore, Samba on an AD domain member can not log the authentication event.
What do you need to know about audit logging in samba?
Samba 4.7 and later supports logging of authentication and authorization events, and Samba 4.9 supported logging of AD DC database changes. This enables you to log, for example, failed authentication requests or password resets. Audit logging is a local setting and you must enable this feature on each Samba server individually.