[Samba] full_audit logs way too much

Rowland Penny rpenny at samba.org
Wed Jun 15 16:12:45 UTC 2022


On Wed, 2022-06-15 at 17:26 +0200, Kees van Vloten via samba wrote:
> Hi Team,
> 
> 
> I have enabled full_audit logging on a (domain-member) file-server 
> (running 4.15.7 from Louis on Bullseye)
> 
> [global]
>          log level = 3
>          full_audit:success = pwrite write rename

There have been changes, try replacing 'rename' with 'renameat'.
I think what is happening is that because 'rename is now an error, it
is defaulting to 'all'.

Rowland





More information about the samba mailing list