samba - Dec 2022 - vfs_full_audit edit file parameter

Hi, 

 

I was doing some testing with the vfs_full_audit parameters. I am wondering
if there is a way to consistently log when a file is edited. 

 

I was able to correlate a file edit with a multiple lines, some
renames/unlinks, but hoping I am missing a simpler option that could be a
single line.

 

Are there other parameters that I may be missing that will show file edits?
Any help is appreciated.

 

Thanks,

Austin

20.12.2022 18:04, Austin Axworthy via samba wrote:
> I was doing some testing with the vfs_full_audit parameters. I am wondering
> if there is a way to consistently log when a file is edited.
> 
> I was able to correlate a file edit with a multiple lines, some
> renames/unlinks, but hoping I am missing a simpler option that could be a
> single line.
There are basically 2 ways of writing a file, - creating new file and
rename (or delete and create new), and open existing file.  It depends on
the application doing things.

/mjt