[Samba] Logging file creation with full_audit

[Jeremy Allison]

On Tue, Jun 15, 2010 at 10:04:57AM -0500, Darren Hildebrand wrote:
> I'm trying to set up a samba server to audit only the file operations  
> that I care about, which are create, modify, delete, and rename (for  
> files and folders).  I've got the full_audit vfs module working well,  
> except that I haven't been able to figure out what to set it to log (in  
> the "full_audit:success" setting) to include file creation and  
> modification.  If I log pwrite, then it floods the logs with many  
> entries for every single file write, especially when writing large  
> files.  I get almost 200 messages when writing a 10 MB file.  Is there  
> something I can log to make it write a single entry on file creation or  
> modification?  "Write" doesn't seem to log anything, but pwrite is far  
> too verbose for my needs.

We don't use "write" anymore - all writes go through pwrite.
You want to log "open", not "pwrite".

Jeremy.