[Samba] Macs deleting files off RHEL8 server.

[I T]

I’ve got a situation with my Macs connecting to a Linux server via SMB
where files/folders are randomly getting deleted from the server. The
server logs are showing that a Mac is deleting them, but I know for a fact
that it’s not human error, as my users are very vigilant in that regard,
and the files/folders have no correlation to each other.Is there anyway of
finding out how/why my Macs are deleting files/folders without any rhyme or
reason? Would appreciate any advice or insight.The computers are a mix of
Intel Mac Mini - macOS 12.7.6 and M2 Mac Mini - macOS 14.7.2, connected via
SMB to a Lenovo SR650 server running RHEL 8 and Lenovo DE6000F SAN.1Gb
ethernet via Cat6 cables through an HP5406zl switch.*nsmb conf file on
Macs:*[default]
signing_required=no
streams=yes
notify_off=yes
port445=no_netbios
soft=yes
dir_cache_max_cnt=0
dir_cache_max=0
dir_cache_off=yes
protocol_vers_map=4
validate_neg_off=yes
mc_on=yes
mc_prefer_wired=yes

*smb config file on server:*[global]
#log level = 6 #####log level = 7 passdb:5:@/var/log/samba/passdb.log
auth:10:@/var/log/samba/auth.log  locking:10:@/var/log/samba/locking.log
scavenger:10:@/var/log/samba/scavenger.log  smb:10:@/var/log/samba/smb.log
smb2:10:@/var/log/samba/smb2.log
smb2_credits:10:@/var/log/samba/smb2_credits.log
fruit:10:@/var/log/samba/fruit.log  preopen:10:@/var/log/samba/preopen.log
recycle:10:@/var/log/samba/recycle.log  auth_audit:10:@/var/log/AuthAudit.log
full_audit:10:@/var/log/fullAudit.log extd_audit:10:@/var/log/extd_audit.log
workgroup = SAMBA
security = user passdb backend = tdbsam# vfs objects = catia fruit
streams_xattr
# fruit:aapl = yes
# fruit:nfs_aces = no
# fruit:resource = file vfs objects = fruit streams_xattr
fruit:metadata = stream
fruit:model = MacSamba
fruit:posix_rename = yes
fruit:veto_appledouble = no
fruit:nfs_aces = no
fruit:wipe_intentionally_left_blank_rfork = yes
fruit:delete_empty_adfiles = yes
    fruit:copyfile = yes
#192.168.6.41-Vista.colourqc.macbook-pro.%S.-4.19.4.log
log file = /var/log/samba/%I-%a.%U.%m.%S.-%v.log
mangled names = no
locking = no printing = cups
printcap name = cups
load printers = yes
cups options = raw[X5]
#########Testing Oct24:
#ea support = yes
#store dos attributes = yes
#full_audit:priority = info
#full_audit:facility = local5
#full_audit:priority = ALERT # 0: emergency level 1: alert, 2: critical, 3:
err, 4: warning, 5: notice: 6: info 7: debug
directory mask = 2777
#
vfs objects = full_audit
#Embassy|araxi|192.168.0.92|hw33240-31|X5|fget_dos_attributes|ok|/raid/data/esfs/X5/Jobs/68272....
full_audit:prefix = Embassy|%U|%I|%m|%S
#Add:  symlinkat readlinkat linkat
# man 8 VFS_FULL_AUDIT  full_audit:failure = all !open  full_audit:failure
= all?
#full_audit:success = close create_file fallocate fget_dos_attributes
fsetxattr lock lstat mkdirat mknodat pwrite_recv pread pread_send pwrite
translate_name unlinkat write
#full_audit:failure = close create_file fallocate fget_dos_attributes
fsetxattr lock lstat mkdirat mknodat pwrite_recv pread pread_send pwrite
translate_name unlinkat write
full_audit:success = all
full_audit:failure = all
# full_audit:failure = read pread write pwrite
##  Bad : full_audit:failure = mkdir pwrite rename rmdir unlink
##### full_audit:facility = local5
##### full_audit:priority = debug
########
browseable = yes
writeable = yes
directory mask = 0777
path = /raid/data/esfs/X5
force create mode = 0777
printable = no
hide files =
/.*/DesktopFolderDB/TrashFor%m/resource.frk/AppleDouble/.DS_Store/_/afpDeleted543089
create mask = 2777
valid users = ***Removed usernames for privacy
hide dot files = yes
force directory mode = 777
vfs objects = full_audit
# full_audit:prefix = Work|%U|%I|%m|%S
# full_audit:success = mkdir pwrite rename rmdir unlink
# full_audit:failure = mkdir pwrite rename rmdir unlink
# full_audit:facility = local5
# full_audit:priority = NOTICE[RAID]
valid users = it
        browseable = no
        writeable = yes
        directory mask = 0777
path = /raid
        force create mode = 0777
        printable = no
        hide files =
/.*/DesktopFolderDB/TrashFor%m/resource.frk/AppleDouble/.DS_Store/_/afpDeleted543089
        create mask = 0777
        hide dot files = yes
        force directory mode = 777
vfs objects = full_audit

Any advice or suggestions would be greatly appreciated.


Kind regards,


*Mike Soliven*
*IT Manager*
Winnipeg, Manitoba, Canada R2X 2Y1
204.697.3338 Ext.1235
www.embassygraphics.com


CONFIDENTIALITY NOTICE: This electronic transmission and any attachment are
the confidential property of the sender, and the materials are privileged
communications intended solely for the receipt, use, benefit, and
information of the intended recipient indicated above. If you are not the
intended recipient, you are hereby notified that any review, disclosure,
copying, distribution, or the taking of any action in reliance on the
contents of this electronic transmission is strictly prohibited, and may
result in legal liability on your part. If you have received this email in
error, please forward back to sender and destroy the electronic
transmission.