Hi, I have a busy Ubuntu 18.04 fileserver running samba 4.7 for which I want to audit only some operations, specifically omitting "open" and "opendir" since they fill the logs very quickly. I have set: full_audit:success = connect unlink rename rmdir ftruncate Tried: full_audit:success = none connect unlink rename rmdir ftruncate full_audit:success = connect unlink rename rmdir ftruncate !open !opendir But no luck, after restarting the daemons (or reload-config) I still get tons of open operations on my log. Have I missed something? What am I doing wrong? Thanks, best regards. -- *Marcio Merlone*