samba - Jun 2007 - Intelligent audit

Hello,

I'm currently using the vfs module "audit" to log actions from
users. I
would like to be able to detect a massive copy of files from a share. I 
tought it could be detected by a hudge number of file opens. But each 
time a user browse a directory in windows, with images or in detailed 
mode, windows open each file. So samba log a lot of useless file opens.

Do you have encountered the same problem ? Do you have any solution ?

Thanks in advance,

Jb Van Puyvelde

On Tue, Jun 12, 2007 at 10:26:54AM +0200, Jb Van Puyvelde
wrote:
> 
> I'm currently using the vfs module "audit" to log actions
from users. I
> would like to be able to detect a massive copy of files from a share. I 
> tought it could be detected by a hudge number of file opens. But each 
> time a user browse a directory in windows, with images or in detailed 
> mode, windows open each file. So samba log a lot of useless file opens.
> 
> Do you have encountered the same problem ? Do you have any solution ?
Unfortunately Windows is actually opening those files, and we can't
tell the difference in intent here.

Jeremy.