samba - Jun 2022 - full_audit logs way too much

Op 15-06-2022 om 20:52 schreef Jeremy Allison:
> On Wed, Jun 15, 2022 at 07:19:10PM +0200, Kees van Vloten via samba 
> wrote:
>>
>> Op 15-06-2022 om 18:12 schreef Rowland Penny via samba:
>>> On Wed, 2022-06-15 at 17:26 +0200, Kees van Vloten via samba wrote:
>>>> Hi Team,
>>>>
>>>>
>>>> I have enabled full_audit logging on a (domain-member)
file-server
>>>> (running 4.15.7 from Louis on Bullseye)
>>>>
>>>> [global]
>>>> ???????? log level = 3
>>>> ???????? full_audit:success = pwrite write rename
>>> There have been changes, try replacing 'rename' with
'renameat'.
>>> I think what is happening is that because 'rename is now an
error, it
>>> is defaulting to 'all'.
>>>
>>> Rowland
>>>
>>>
>> Thanks Rowland, that is indeed the case. Issue solved!
>>
>> Strangely enough 'smbcontrol all reload-config' was not enough
to
>> change it, I had to restart smbd to activate the changed config item.
>
> That's becasue it's a VFS-object specific parameter.
> They are only read when the VFS is fist connected to.
>
> If you have an existing connection, 'smbcontrol all reload-config'
> won't cause it to be dropped and re-loaded (for obvious
> reasons :-).
Hi Jeremy,

With your explanation it is easy to understand why it works like it 
does. But users cannot know or guess this behaviour, I suppose? At least 
I would never have thought about it, also it feels inconsistent.

If I understand you correctly it is not easy to change the code to 
instruct the vfs to reload-config. Then it comes down to writing it in 
the docs, but who ever reads those before running into the issue :-)

- Kees

On Wed, Jun 15, 2022 at 10:00:20PM +0200, Kees van Vloten
wrote:
>Op 15-06-2022 om 20:52 schreef Jeremy Allison:
>>They are only read when the VFS is fist connected to.
>>
>>If you have an existing connection, 'smbcontrol all
reload-config'
>>won't cause it to be dropped and re-loaded (for obvious
>>reasons :-).
>Hi Jeremy,
>
>With your explanation it is easy to understand why it works like it 
>does. But users cannot know or guess this behaviour, I suppose? At 
>least I would never have thought about it, also it feels inconsistent.
>
>If I understand you correctly it is not easy to change the code to 
>instruct the vfs to reload-config. Then it comes down to writing it in 
>the docs, but who ever reads those before running into the issue :-)
It may be inconsistent, but it's essentially impossible to
change, so I suggest to live with it :-).

There are other things in Samba that can't be changed with
'smbcontrol all reload-config' once they've been initialized
and there are live connections, so it's not too unexpected.