[Samba] Intelligent audit

[Jb Van Puyvelde]

Hello,

I'm currently using the vfs module "audit" to log actions from users. I 
would like to be able to detect a massive copy of files from a share. I 
tought it could be detected by a hudge number of file opens. But each 
time a user browse a directory in windows, with images or in detailed 
mode, windows open each file. So samba log a lot of useless file opens.

Do you have encountered the same problem ? Do you have any solution ?

Thanks in advance,

Jb Van Puyvelde