[Samba] Macs deleting files off RHEL8 server.

[Rowland Penny]

On Mon, 12 May 2025 13:51:39 -0500
I T via samba <samba at lists.samba.org> wrote:

> I’ve got a situation with my Macs connecting to a Linux server via SMB
> where files/folders are randomly getting deleted from the server. The
> server logs are showing that a Mac is deleting them, but I know for a
> fact that it’s not human error, as my users are very vigilant in that
> regard, and the files/folders have no correlation to each other.Is
> there anyway of finding out how/why my Macs are deleting
> files/folders without any rhyme or reason? Would appreciate any
> advice or insight.The computers are a mix of Intel Mac Mini - macOS
> 12.7.6 and M2 Mac Mini - macOS 14.7.2, connected via SMB to a Lenovo
> SR650 server running RHEL 8 and Lenovo DE6000F SAN.1Gb ethernet via
> Cat6 cables through an HP5406zl switch.*nsmb conf file on
> Macs:*[default] signing_required=no
> streams=yes
> notify_off=yes
> port445=no_netbios
> soft=yes
> dir_cache_max_cnt=0
> dir_cache_max=0
> dir_cache_off=yes
> protocol_vers_map=4
> validate_neg_off=yes
> mc_on=yes
> mc_prefer_wired=yes
> 
> *smb config file on server:*[global]
> #log level = 6 #####log level = 7 passdb:5:@/var/log/samba/passdb.log
> auth:10:@/var/log/samba/auth.log
> locking:10:@/var/log/samba/locking.log
> scavenger:10:@/var/log/samba/scavenger.log
> smb:10:@/var/log/samba/smb.log smb2:10:@/var/log/samba/smb2.log
> smb2_credits:10:@/var/log/samba/smb2_credits.log
> fruit:10:@/var/log/samba/fruit.log
> preopen:10:@/var/log/samba/preopen.log
> recycle:10:@/var/log/samba/recycle.log
> auth_audit:10:@/var/log/AuthAudit.log
> full_audit:10:@/var/log/fullAudit.log
> extd_audit:10:@/var/log/extd_audit.log workgroup = SAMBA security =
> user passdb backend = tdbsam# vfs objects = catia fruit streams_xattr
> # fruit:aapl = yes # fruit:nfs_aces = no # fruit:resource = file vfs
> objects = fruit streams_xattr fruit:metadata = stream
> fruit:model = MacSamba
> fruit:posix_rename = yes
> fruit:veto_appledouble = no
> fruit:nfs_aces = no
> fruit:wipe_intentionally_left_blank_rfork = yes
> fruit:delete_empty_adfiles = yes
>     fruit:copyfile = yes
> #192.168.6.41-Vista.colourqc.macbook-pro.%S.-4.19.4.log
> log file = /var/log/samba/%I-%a.%U.%m.%S.-%v.log
> mangled names = no
> locking = no printing = cups
> printcap name = cups
> load printers = yes
> cups options = raw[X5]
> #########Testing Oct24:
> #ea support = yes
> #store dos attributes = yes
> #full_audit:priority = info
> #full_audit:facility = local5
> #full_audit:priority = ALERT # 0: emergency level 1: alert, 2:
> critical, 3: err, 4: warning, 5: notice: 6: info 7: debug
> directory mask = 2777
> #
> vfs objects = full_audit
> #Embassy|araxi|192.168.0.92|hw33240-31|X5|fget_dos_attributes|ok|/raid/data/esfs/X5/Jobs/68272....
> full_audit:prefix = Embassy|%U|%I|%m|%S
> #Add:  symlinkat readlinkat linkat
> # man 8 VFS_FULL_AUDIT  full_audit:failure = all !open
> full_audit:failure = all?
> #full_audit:success = close create_file fallocate fget_dos_attributes
> fsetxattr lock lstat mkdirat mknodat pwrite_recv pread pread_send
> pwrite translate_name unlinkat write
> #full_audit:failure = close create_file fallocate fget_dos_attributes
> fsetxattr lock lstat mkdirat mknodat pwrite_recv pread pread_send
> pwrite translate_name unlinkat write
> full_audit:success = all
> full_audit:failure = all
> # full_audit:failure = read pread write pwrite
> ##  Bad : full_audit:failure = mkdir pwrite rename rmdir unlink
> ##### full_audit:facility = local5
> ##### full_audit:priority = debug
> ########
> browseable = yes
> writeable = yes
> directory mask = 0777
> path = /raid/data/esfs/X5
> force create mode = 0777
> printable = no
> hide files =
> /.*/DesktopFolderDB/TrashFor%m/resource.frk/AppleDouble/.DS_Store/_/afpDeleted543089
> create mask = 2777
> valid users = ***Removed usernames for privacy
> hide dot files = yes
> force directory mode = 777
> vfs objects = full_audit
> # full_audit:prefix = Work|%U|%I|%m|%S
> # full_audit:success = mkdir pwrite rename rmdir unlink
> # full_audit:failure = mkdir pwrite rename rmdir unlink
> # full_audit:facility = local5
> # full_audit:priority = NOTICE[RAID]
> valid users = it
>         browseable = no
>         writeable = yes
>         directory mask = 0777
> path = /raid
>         force create mode = 0777
>         printable = no
>         hide files =
> /.*/DesktopFolderDB/TrashFor%m/resource.frk/AppleDouble/.DS_Store/_/afpDeleted543089
>         create mask = 0777
>         hide dot files = yes
>         force directory mode = 777
> vfs objects = full_audit
> 
> Any advice or suggestions would be greatly appreciated.
> 
> 
>

If that is the actual smb.conf from your Samba standalone server, then
you do not seem to have any shares, there are no '[SHARENAME]' lines,
can you please post the output of 'testparm -s'

Rowland