[Samba] Intelligent audit

[Jeremy Allison]

On Tue, Jun 12, 2007 at 10:26:54AM +0200, Jb Van Puyvelde wrote:
> 
> I'm currently using the vfs module "audit" to log actions from users. I 
> would like to be able to detect a massive copy of files from a share. I 
> tought it could be detected by a hudge number of file opens. But each 
> time a user browse a directory in windows, with images or in detailed 
> mode, windows open each file. So samba log a lot of useless file opens.
> 
> Do you have encountered the same problem ? Do you have any solution ?

Unfortunately Windows is actually opening those files, and we can't
tell the difference in intent here.

Jeremy.