[Samba] Quick question about full_audit

[Marcio Merlone]

Hi,

I have a busy Ubuntu 18.04 fileserver running samba 4.7 for which I want 
to audit only some operations, specifically omitting "open" and 
"opendir" since they fill the logs very quickly.

I have set:

full_audit:success = connect unlink rename rmdir ftruncate

Tried:

full_audit:success = none connect unlink rename rmdir ftruncate

full_audit:success = connect unlink rename rmdir ftruncate !open !opendir

But no luck, after restarting the daemons (or reload-config) I still get 
tons of open operations on my log. Have I missed something? What am I 
doing wrong?

Thanks, best regards.


-- 
*Marcio Merlone*