[Samba] full_audit logs way too much
Jeremy Allison
jra at samba.org
Wed Jun 15 18:55:26 UTC 2022
On Wed, Jun 15, 2022 at 05:12:45PM +0100, Rowland Penny via samba wrote:
>On Wed, 2022-06-15 at 17:26 +0200, Kees van Vloten via samba wrote:
>> Hi Team,
>>
>>
>> I have enabled full_audit logging on a (domain-member) file-server
>> (running 4.15.7 from Louis on Bullseye)
>>
>> [global]
>> log level = 3
>> full_audit:success = pwrite write rename
>
>There have been changes, try replacing 'rename' with 'renameat'.
>I think what is happening is that because 'rename is now an error, it
>is defaulting to 'all'.
We should probably just log a debug message
about the unknown name and then ignore the
unknown name instead of going full "ALL"
on the audit.
Rowland, can you log a bug on this so
we can track getting a fix. This problem keeps
coming up and is a pain point for users.
Thanks !
Jeremy.
More information about the samba
mailing list