[Samba] vfs_full_audit log question

[Kees van Vloten]

Op 11-09-2023 om 12:14 schreef d tbsky via samba:
> Hi:
>    today my user report one directory at the samba share disappeared.
> I had create the vfs_full_audit like below:
>
>     vfs objects = recycle full_audit
>     full_audit:priority = notice
>     full_audit:facility = local5
>     full_audit:success = mkdirat renameat unlinkat
>     full_audit:failure = none
>     full_audit:prefix = %u|%I
>
> but I can not find the related log about the missing directory.
> normally I can find deleted/renamed files via the log. I wonder if
> there is some other vfs operations  I should add for monitor
> directories?
>
> thanks a lot for your help!
Is your question, what full_audit property to add to see a missing 
directory? What exactly do you want to see, the deletion or  a failing 
call that tries to read it or something else?
>