Set ACL audit log is missing in SMB audit log

TrueNAS General
,
1

Hello Experts,

I have enabled SMB auditing on the SMB share. When I modify the ACLs on the share, the “Set ACL” event appears correctly in the WebUI.

image

However, I am facing two issues with the audit logs:

  1. No logs in smb.db: The Set ACL events are not recorded in the smb.db file under the /audit folder (though “UNLINK” events can be searched successfully).
  2. No logs in Syslog: I forwarded the audit logs to a syslog server, but the Set ACL logs are still missing there as well.
2

I would have thought that that should be reported as a bug

3

The UI queries the database. If you see it in the UI, it’ll be in the database. IIRC the UI relabels some of the event types so you’ll need to do your SQL against the actual event type and not what the UI shows.

SET_ACL not “Set ACL”

4

Still no related logs

image

5

UI team now has ticket NAS-141703 to review and update labelling for SMB audit entry types in the UI.

1 Like
6

event_data is a JSON blob containing the event data. You want event if you’re filtering for event type.

1 Like
7

You are right! I used the wrong command :rofl: