[Samba] vfs_full_audit edit file parameter

[Austin Axworthy]

Hi Michael,

I appreciate your reply. I am more focussed on when a file is edited. I was
able to test multiple different file edits and could consistently come to
the following log lines, using renameat and unlinkat.

renameat|ok /tank/samba/word.docx|/tank/samba/8E9152BF.tmp
renameat|ok|/tank/samba/word.docx
unlinkat|ok|/tank/samba/8E9152BF.tmp

I do agree it will differ depending on application, was just hoping there
was a more direct/consistent way people may have found to log file edits
specifically. 

Thanks,
Austin

-----Original Message-----
From: samba <samba-bounces at lists.samba.org> On Behalf Of Michael Tokarev via
samba
Sent: December 20, 2022 11:21 AM
To: Austin Axworthy <aaxworthy at 45drives.com>; samba at lists.samba.org
Subject: Re: [Samba] vfs_full_audit edit file parameter

20.12.2022 18:04, Austin Axworthy via samba wrote:
> I was doing some testing with the vfs_full_audit parameters. I am 
> wondering if there is a way to consistently log when a file is edited.
> 
> I was able to correlate a file edit with a multiple lines, some 
> renames/unlinks, but hoping I am missing a simpler option that could 
> be a single line.

There are basically 2 ways of writing a file, - creating new file and rename
(or delete and create new), and open existing file.  It depends on the
application doing things.

/mjt

--
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba