[Samba] full_audit logs way too much

Jeremy Allison jra at samba.org
Wed Jun 15 18:52:38 UTC 2022

On Wed, Jun 15, 2022 at 07:19:10PM +0200, Kees van Vloten via samba wrote:
>Op 15-06-2022 om 18:12 schreef Rowland Penny via samba:
>>On Wed, 2022-06-15 at 17:26 +0200, Kees van Vloten via samba wrote:
>>>Hi Team,
>>>I have enabled full_audit logging on a (domain-member) file-server
>>>(running 4.15.7 from Louis on Bullseye)
>>>          log level = 3
>>>          full_audit:success = pwrite write rename
>>There have been changes, try replacing 'rename' with 'renameat'.
>>I think what is happening is that because 'rename is now an error, it
>>is defaulting to 'all'.
>Thanks Rowland, that is indeed the case. Issue solved!
>Strangely enough 'smbcontrol all reload-config' was not enough to 
>change it, I had to restart smbd to activate the changed config item.

That's becasue it's a VFS-object specific parameter.
They are only read when the VFS is fist connected to.

If you have an existing connection, 'smbcontrol all reload-config'
won't cause it to be dropped and re-loaded (for obvious
reasons :-).

More information about the samba mailing list