On Tue, Apr 05, 2022 at 04:39:20PM +0200, Stefan Kania via samba wrote:> Hi to all, > > short question: > If I activate auditing in smb.conf like this: > -------- > full_audit:failure = none > full_audit:success = renameat create_file write > full_audit:prefix = IP=%I|USER=%u|MACHINE=%m|VOLUME=%S > full_audit:facility = local5 > full_audit:priority = NOTICE > -------- > I see > > .....VOLUME=xxx|create_file|ok|0x100081|file|open|/xxx > > ------- > What is the meaning of the HEX value "0x100081"That is the "desired access" from the create request. In this case, the client is asking to open the file with READ_DATA and READ_ATTRIBUTES (and SYNCHRONIZE which is basically ignored). Christof
Am 05.04.22 um 19:08 schrieb Christof Schmitt:> On Tue, Apr 05, 2022 at 04:39:20PM +0200, Stefan Kania via samba wrote: >> Hi to all, >> >> short question: >> If I activate auditing in smb.conf like this: >> -------- >> full_audit:failure = none >> full_audit:success = renameat create_file write >> full_audit:prefix = IP=%I|USER=%u|MACHINE=%m|VOLUME=%S >> full_audit:facility = local5 >> full_audit:priority = NOTICE >> -------- >> I see >> >> .....VOLUME=xxx|create_file|ok|0x100081|file|open|/xxx >> >> ------- >> What is the meaning of the HEX value "0x100081" > > That is the "desired access" from the create request. In this case, the > client is asking to open the file with READ_DATA and READ_ATTRIBUTES > (and SYNCHRONIZE which is basically ignored).Is there a list with all the used values? Or do I have to seach through the source-code?> > Christof