[Samba] vfs_full_audit edit file parameter

Austin Axworthy aaxworthy at 45drives.com
Tue Dec 20 15:37:32 UTC 2022

Hi Michael,

I appreciate your reply. I am more focussed on when a file is edited. I was
able to test multiple different file edits and could consistently come to
the following log lines, using renameat and unlinkat.

renameat|ok /tank/samba/word.docx|/tank/samba/8E9152BF.tmp

I do agree it will differ depending on application, was just hoping there
was a more direct/consistent way people may have found to log file edits


-----Original Message-----
From: samba <samba-bounces at lists.samba.org> On Behalf Of Michael Tokarev via
Sent: December 20, 2022 11:21 AM
To: Austin Axworthy <aaxworthy at 45drives.com>; samba at lists.samba.org
Subject: Re: [Samba] vfs_full_audit edit file parameter

20.12.2022 18:04, Austin Axworthy via samba wrote:
> I was doing some testing with the vfs_full_audit parameters. I am 
> wondering if there is a way to consistently log when a file is edited.
> I was able to correlate a file edit with a multiple lines, some 
> renames/unlinks, but hoping I am missing a simpler option that could 
> be a single line.

There are basically 2 ways of writing a file, - creating new file and rename
(or delete and create new), and open existing file.  It depends on the
application doing things.


To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba

More information about the samba mailing list