samba - Jun 2007 - VFS Full Audit module forces logging of failures

Hi All,

I have taken a look through the vfs_full_audit.c module in
samba-3.0.10/source/modules/ and it seems that there is no way to turn off
logging of *some sort* of failure event...

There is the concept of a 'none' list of ops (this is the default for
the
success event), and there is a concept of an 'all' list of ops (the
default for the failure event), but there is no way to actually specify
'none' for failure. If the success event is simply not specified in the
config file, no success events will be logged, but if the failure event is
omitted from the config file, every failure will be logged. Is this
intentional, or simply an oversight? Shall I send through a patch to
implement this behaviour, and if so, to this list?

Cheers,
Darryl Dixon
Winterhouse Consulting Ltd
http://www.winterhouseconsulting.com
+64 21 33 44 13

On Thu, Jun 14, 2007 at 12:27:41PM +1200, Darryl Dixon - Winterhouse Consulting
wrote:
> Hi All,
> 
> I have taken a look through the vfs_full_audit.c module in
> samba-3.0.10/source/modules/ and it seems that there is no way to turn off
> logging of *some sort* of failure event...
> 
> There is the concept of a 'none' list of ops (this is the default
for the
> success event), and there is a concept of an 'all' list of ops (the
> default for the failure event), but there is no way to actually specify
> 'none' for failure. If the success event is simply not specified in
the
> config file, no success events will be logged, but if the failure event is
> omitted from the config file, every failure will be logged. Is this
> intentional, or simply an oversight? Shall I send through a patch to
> implement this behaviour, and if so, to this list?
Yes please, that would be most welcome. Please start with
the Samba 3.0.25 source code though, as this is the current
version.

Jeremy.