samba - May 2014 - File deletion auditing

Hello everyone 


I'm testing the module vfs_full_audit on samba 4.0.17 under FreeBSD 10, i
couldn't figure out how to audit file deletions only directories, is this
possible ? This is my share setup.


[share1] 
vfs objects = aio_pthread,zfsacl 
aio read size = 32768 
aio write size = 32768 
full_audit:success = write mkdir rmdir pwrite rename 
full_audit:failure = write mkdir rmdir pwrite rename 
full_audit:facility = LOCAL0 
full_audit:priority = NOTICE 
path=/samba-rb/test_share 
writable = yes 
browsable = yes 

inherit owner = yes

Hi Dante,

On Wed, 28 May 2014 09:30:48 -0300 (BRT), Dante Colo wrote:
> I'm testing the module vfs_full_audit on samba 4.0.17 under FreeBSD 10,
i couldn't figure out how to audit file deletions only directories, is this
possible ? This is my share setup.
> 
> 
> [share1] 
> vfs objects = aio_pthread,zfsacl 
The full audit VFS module needs to be enabled for the share, e.g.
  vfs objects = full_audit aio_pthread zfsacl

Cheers, David