[Samba] full_audit logs way too much

Rowland Penny rpenny at samba.org
Wed Jun 15 19:11:28 UTC 2022


On Wed, 2022-06-15 at 11:55 -0700, Jeremy Allison wrote:
> On Wed, Jun 15, 2022 at 05:12:45PM +0100, Rowland Penny via samba
> wrote:
> > On Wed, 2022-06-15 at 17:26 +0200, Kees van Vloten via samba wrote:
> > > Hi Team,
> > > 
> > > 
> > > I have enabled full_audit logging on a (domain-member) file-
> > > server
> > > (running 4.15.7 from Louis on Bullseye)
> > > 
> > > [global]
> > >          log level = 3
> > >          full_audit:success = pwrite write rename
> > 
> > There have been changes, try replacing 'rename' with 'renameat'.
> > I think what is happening is that because 'rename is now an error,
> > it
> > is defaulting to 'all'.
> 
> We should probably just log a debug message
> about the unknown name and then ignore the
> unknown name instead of going full "ALL"
> on the audit.
> 
> Rowland, can you log a bug on this so
> we can track getting a fix. This problem keeps
> coming up and is a pain point for users.
> 
> Thanks !
> 
> Jeremy.

Done, see:
https://bugzilla.samba.org/show_bug.cgi?id=15098

Rowland





More information about the samba mailing list