logging: add ldb audit classes

Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

diff --git a/docs-xml/smbdotconf/logging/loglevel.xml b/docs-xml/smbdotconf/logging/loglevel.xml
index fae5c7b079e7b53c7467b84efac0331f8898f82c..ffd907508b6711cb9a2e96bf854a8ed61f988851 100644 (file)
--- a/docs-xml/smbdotconf/logging/loglevel.xml
+++ b/docs-xml/smbdotconf/logging/loglevel.xml
@@ -46,6 +46,12 @@
         <listitem><para><parameter moreinfo="none">auth_audit</parameter></para></listitem>
         <listitem><para><parameter moreinfo="none">auth_json_audit</parameter></para></listitem>
         <listitem><para><parameter moreinfo="none">kerberos</parameter></para></listitem>
+        <listitem><para><parameter moreinfo="none">dsdb_audit</parameter></para></listitem>
+        <listitem><para><parameter moreinfo="none">dsdb_json_audit</parameter></para></listitem>
+        <listitem><para><parameter moreinfo="none">dsdb_password_audit</parameter></para></listitem>
+        <listitem><para><parameter moreinfo="none">dsdb_password_json_audit</parameter></para></listitem>
+        <listitem><para><parameter moreinfo="none">dsdb_transaction_audit</parameter></para></listitem>
+        <listitem><para><parameter moreinfo="none">dsdb_transaction_json_audit</parameter></para></listitem>
     </itemizedlist>
 
     <para>Authentication and authorization audit information is logged
@@ -58,7 +64,7 @@
     as well as the implicit authentication in password changes.  In
     the file server, NTLM authentication, SMB and RPC authorization is
     covered.</para>
-    
+
     <para>Log levels for auth_audit and auth_audit_json are:</para>
     <itemizedlist>
        <listitem><para>2: Authentication Failure</para></listitem>
@@ -66,9 +72,25 @@
        <listitem><para>4: Authorization Success</para></listitem>
        <listitem><para>5: Anonymous Authentication and Authorization Success</para></listitem>
     </itemizedlist>
-    
 
-    
+    <para>Changes to the sam.ldb database are logged
+    under the dsdb_audit, and if Samba was not compiled with
+    --without-json-audit, a JSON representation is logged under
+    dsdb_json_audit.</para>
+
+    <para>Password changes and Password resets are logged under
+    dsdb_password_audit, and if Samba was not compiled with
+    --without-json-audit, a JSON representation is logged under the
+    dsdb_password_json_audit.</para>
+
+    <para>Transaction rollbacks and prepare commit failures are logged under
+    the dsdb_transaction_audit, and if Samba was not compiled with
+    --without-json-audit, a JSON representation is logged under the
+    password_json_audit. Logging the transaction details allows the
+    identification of password and sam.ldb operations that have been rolled
+    back.</para>
+
+
 </description>
 <value type="default">0</value>
 <value type="example">3 passdb:5 auth:10 winbind:2</value>

diff --git a/lib/util/debug.c b/lib/util/debug.c
index d010b724203af52a79e19897d5772384d17dc8cc..d7b641e4384bd80a40f1b98fb24958e031e04c41 100644 (file)
--- a/lib/util/debug.c
+++ b/lib/util/debug.c
@@ -543,6 +543,12 @@ static const char *default_classname_table[] = {
        [DBGC_DRS_REPL] =       "drs_repl",
        [DBGC_SMB2] =           "smb2",
        [DBGC_SMB2_CREDITS] =   "smb2_credits",
+       [DBGC_DSDB_AUDIT]  =    "dsdb_audit",
+       [DBGC_DSDB_AUDIT_JSON] = "dsdb_json_audit",
+       [DBGC_DSDB_PWD_AUDIT]  =        "dsdb_password_audit",
+       [DBGC_DSDB_PWD_AUDIT_JSON] = "dsdb_password_json_audit",
+       [DBGC_DSDB_TXN_AUDIT]  =        "dsdb_transaction_audit",
+       [DBGC_DSDB_TXN_AUDIT_JSON] = "dsdb_transaction_json_audit",
 };
 
 /*

diff --git a/lib/util/debug.h b/lib/util/debug.h
index 1e184b47de920257b47456c264e5fe66b851d1f8..8d285cd7b0f09c7001f1c9dbaf28ff254c2cff9b 100644 (file)
--- a/lib/util/debug.h
+++ b/lib/util/debug.h
@@ -95,6 +95,12 @@ bool dbghdr( int level, const char *location, const char *func);
 #define DBGC_DRS_REPL           27
 #define DBGC_SMB2               28
 #define DBGC_SMB2_CREDITS       29
+#define DBGC_DSDB_AUDIT        30
+#define DBGC_DSDB_AUDIT_JSON   31
+#define DBGC_DSDB_PWD_AUDIT            32
+#define DBGC_DSDB_PWD_AUDIT_JSON       33
+#define DBGC_DSDB_TXN_AUDIT            34
+#define DBGC_DSDB_TXN_AUDIT_JSON       35
 
 /* So you can define DBGC_CLASS before including debug.h */
 #ifndef DBGC_CLASS