https://bugzilla.novell.com/show_bug.cgi?id=749786 https://bugzilla.novell.com/show_bug.cgi?id=749786#c1 David Disseldorp changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |ddiss@suse.com, | |hhetter@suse.com --- Comment #1 from David Disseldorp 2012-03-02 13:21:46 UTC --- Thanks for the report Divesh. Do you know whether this is also the case in Samba 3.6.3, as shipped with SLES 11 SP2? SMB Traffic Analyzer uses the same method to obtain the filename on close: 889 static int smb_traffic_analyzer_close(vfs_handle_struct *handle, \ 890 files_struct *fsp) 891 { 892 struct close_data s_data; 893 s_data.result = SMB_VFS_NEXT_CLOSE(handle, fsp); 894 DEBUG(10,("smb_traffic_analyzer_close: CLOSE: %s\n", 895 fsp_str_dbg(fsp))); 896 s_data.filename = fsp->fsp_name->base_name; 897 smb_traffic_analyzer_send_data(handle, 898 &s_data, 899 vfs_id_close); 900 return s_data.result; 901 } @Holger have you run into this problem? As a (very ugly) workaround for now you may wish to use readlink(), feeding it a /proc/self/fd/$FD path where $FD = fsp->fh->fd. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=749786 https://bugzilla.novell.com/show_bug.cgi?id=749786#c3 --- Comment #3 from Divesh Uppoor 2012-03-02 13:57:49 UTC --- We have not tried with Samba 3.6.3 as we have to compile with the default version (i.e. samba-3.4.3) shipped with SLES 11 SP1. The workaround could possibly slow down the process in-order to get the name of the file. A solution would be helpful if a patch is provided. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=749786 https://bugzilla.novell.com/show_bug.cgi?id=749786#c5 --- Comment #5 from Divesh Uppoor 2012-03-02 14:29:45 UTC --- (In reply to comment #1)

Thanks for the report Divesh.

Do you know whether this is also the case in Samba 3.6.3, as shipped with SLES 11 SP2?

SMB Traffic Analyzer uses the same method to obtain the filename on close: 889 static int smb_traffic_analyzer_close(vfs_handle_struct *handle, \ 890 files_struct *fsp) 891 { 892 struct close_data s_data; 893 s_data.result = SMB_VFS_NEXT_CLOSE(handle, fsp); 894 DEBUG(10,("smb_traffic_analyzer_close: CLOSE: %s\n", 895 fsp_str_dbg(fsp))); 896 s_data.filename = fsp->fsp_name->base_name; 897 smb_traffic_analyzer_send_data(handle, 898 &s_data, 899 vfs_id_close); 900 return s_data.result; 901 }

@Holger have you run into this problem?

As a (very ugly) workaround for now you may wish to use readlink(), feeding it a /proc/self/fd/$FD path where $FD = fsp->fh->fd.

I already noticed that files_struct structure which has fsp_name member which is of type string, and not the structure so that we can access base_name in samba-3.4.3. According to above code as this one, s_data.filename = fsp->fsp_name->base_name; This is possible in samba-3.5.0, where fsp->fsp_name is structure so that we can access base_name. Even also tried accessing file name using fsp->fsp_name->base_name in samba-3.5.0, but same problem persist i.e getting filename value 'null'. But we need to work only on samba-3.4.3. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=749786 https://bugzilla.novell.com/show_bug.cgi?id=749786#c7 --- Comment #7 from James McDonough 2012-03-13 16:58:25 UTC --- (In reply to comment #1)

Thanks for the report Divesh.

Do you know whether this is also the case in Samba 3.6.3, as shipped with SLES 11 SP2? On 64-bit 3.6.3, the filename is there when I debug vfs_full_audit.

-- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

I've seen it now on 3.4.3, SLE11SP1, 64-bit. fsp_name isn't null, but "" on close. Sorry, my mistake, it did not occur. I was simply trying to smbopen a

https://bugzilla.novell.com/show_bug.cgi?id=749786 https://bugzilla.novell.com/show_bug.cgi?id=749786#c9 --- Comment #9 from James McDonough 2012-03-14 14:15:59 UTC --- (In reply to comment #8) directory, so fd_close was called to do cleanup on a file which wasn't successfully opened. I will try to duplicate this with 32-bit packages. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=749786 https://bugzilla.novell.com/show_bug.cgi?id=749786#c11 --- Comment #11 from Divesh Uppoor 2012-03-19 07:05:55 UTC --- (In reply to comment #10)

On 3.6.3, it does contain the name, even when the VFS_CLOSE is invoked on a failed open attempt. Can you confirm that your failure case with 3.4.3 is on _all_ closes and not just closes occuring after failed opens?

My failure case with 3.4.3 is on _all_ closes and not just closes occuring after failed opens. I am unable to get filename in any case in vfs-close operation. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=749786 https://bugzilla.novell.com/show_bug.cgi?id=749786#c13 --- Comment #13 from Lars Müller 2012-04-01 10:45:08 CEST --- @Divesh: Is this issue solved for you or do you need more time to collect the requested information? -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=749786 https://bugzilla.novell.com/show_bug.cgi?id=749786#c15 --- Comment #15 from Divesh Uppoor 2012-04-02 07:40:42 UTC --- Created an attachment (id=484398) --> (http://bugzilla.novell.com/attachment.cgi?id=484398) smb.conf pls find attached is the smb.conf. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=749786 https://bugzilla.novell.com/show_bug.cgi?id=749786#c17 --- Comment #17 from Divesh Uppoor 2012-04-02 07:52:29 UTC --- Created an attachment (id=484403) --> (http://bugzilla.novell.com/attachment.cgi?id=484403) smb.conf from SLES smb.conf from sles -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=749786 https://bugzilla.novell.com/show_bug.cgi?id=749786#c Lars Müller changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #484398|application/octet-stream |text/plain mime type| | -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=749786 https://bugzilla.novell.com/show_bug.cgi?id=749786#c19 --- Comment #19 from Divesh Uppoor 2012-04-09 08:19:36 UTC --- (In reply to comment #18)

I see no stacked modules. How are you building your module?

I would like to see the output of the shipped full_audit module, logging both open and close on success and failure. These will show the names.

Will you please elaborate how to take the output of the shipped full_audit module, logging both open and close on success and failure. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=749786 https://bugzilla.novell.com/show_bug.cgi?id=749786#c21 --- Comment #21 from Divesh Uppoor 2012-04-17 09:39:29 UTC --- Created an attachment (id=486404) --> (http://bugzilla.novell.com/attachment.cgi?id=486404) This file contains logs of open and close on success and failure -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=749786 https://bugzilla.novell.com/show_bug.cgi?id=749786#c23 --- Comment #23 from Divesh Uppoor 2012-04-17 09:43:14 UTC --- (In reply to comment #20)

from the man page for vfs_full_audit:

path = /data/records vfs objects = full_audit full_audit:prefix = %u|%I full_audit:success = open opendir full_audit:failure = all !open full_audit:facility = LOCAL7 full_audit:priority = ALERT

So, change success and failure options to "open close", and the others you can set as works best for your syslog.

Below I have attached two log files one which contains log of every operation and other which contains logs of only open and close operations. Those are outputs of the shipped full_audit module, logging on success and failure. Though I can see the names of files in vfs_full_audit log but I am unable to get names of downloaded and uploaded files in vfs close operation. I mean fsp->fsp_name value 'null' in vfs close operation. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.