[Samba] vfs_recycle missing deleted file?

[Valentijn Sessink]

Hi,

With smb.conf having full_audit and recycle, today I saw:

Sep 17 10:48:49 kantoor smbd_audit[2317861]: 
hannah|192.168.1.26|ashare|unlinkat|ok|/home/ashare/Documents/20240917Workflow.ods

However, there's no /home/.recycle/hannah/Documents/ or any other hint 
of 20240917Workflow.ods in her recycle directory. As there is a copy of 
the last version of this file (in another users directory) which has a 
file size of 42266 bytes, I can't think of the 1023 size limit being in 
action here.

But then: how can an unlinked file not end up in the recycle directory?

smb.conf excerpt:

         full_audit:prefix = %u|%I|%S
         full_audit:failure = connect
         full_audit:success = connect disconnect mkdirat open openat 
create_file close read pread pread_recv write pwrite pwrite_send 
sendfile renameat unlinkat ftruncate
         full_audit:facility = local5
         full_audit:priority = notice

         recycle:minsize = 1023
         recycle:repository = /home/.recycle/%U
         recycle:keeptree = yes
         recycle:versions = yes

[ashare]
   vfs objects = fruit streams_xattr full_audit recycle


Anyone any idea? This is with an older version of Samba, Ubuntu version 
2:4.15.13+dfsg-0ubuntu0.20.04.7

Best regards,

Valentijn