[Samba] Logging file creation with full_audit
jra at samba.org
Tue Jun 15 11:09:10 MDT 2010
On Tue, Jun 15, 2010 at 10:04:57AM -0500, Darren Hildebrand wrote:
> I'm trying to set up a samba server to audit only the file operations
> that I care about, which are create, modify, delete, and rename (for
> files and folders). I've got the full_audit vfs module working well,
> except that I haven't been able to figure out what to set it to log (in
> the "full_audit:success" setting) to include file creation and
> modification. If I log pwrite, then it floods the logs with many
> entries for every single file write, especially when writing large
> files. I get almost 200 messages when writing a 10 MB file. Is there
> something I can log to make it write a single entry on file creation or
> modification? "Write" doesn't seem to log anything, but pwrite is far
> too verbose for my needs.
We don't use "write" anymore - all writes go through pwrite.
You want to log "open", not "pwrite".
More information about the samba