[Samba] vfs_full_audit edit file parameter

[Michael Tokarev]

20.12.2022 18:04, Austin Axworthy via samba wrote:
> I was doing some testing with the vfs_full_audit parameters. I am wondering
> if there is a way to consistently log when a file is edited.
> 
> I was able to correlate a file edit with a multiple lines, some
> renames/unlinks, but hoping I am missing a simpler option that could be a
> single line.

There are basically 2 ways of writing a file, - creating new file and
rename (or delete and create new), and open existing file.  It depends on
the application doing things.

/mjt