Hi: today my user report one directory at the samba share disappeared. I had create the vfs_full_audit like below: vfs objects = recycle full_audit full_audit:priority = notice full_audit:facility = local5 full_audit:success = mkdirat renameat unlinkat full_audit:failure = none full_audit:prefix = %u|%I but I can not find the related log about the missing directory. normally I can find deleted/renamed files via the log. I wonder if there is some other vfs operations I should add for monitor directories? thanks a lot for your help!
On Mon, 11 Sep 2023 18:14:00 +0800 d tbsky via samba <samba at lists.samba.org> wrote:> Hi: > today my user report one directory at the samba share disappeared. > I had create the vfs_full_audit like below: > > vfs objects = recycle full_audit > full_audit:priority = notice > full_audit:facility = local5 > full_audit:success = mkdirat renameat unlinkat > full_audit:failure = none > full_audit:prefix = %u|%I > > but I can not find the related log about the missing directory. > normally I can find deleted/renamed files via the log. I wonder if > there is some other vfs operations I should add for monitor > directories? > > thanks a lot for your help! >Please do not post a portion of your smb.conf , it is useless without the rest of the smb.conf , there is no context. What I will say is, if you have other 'vfs objects' set, then you have turned them off. Rowland
Op 11-09-2023 om 12:14 schreef d tbsky via samba:> Hi: > today my user report one directory at the samba share disappeared. > I had create the vfs_full_audit like below: > > vfs objects = recycle full_audit > full_audit:priority = notice > full_audit:facility = local5 > full_audit:success = mkdirat renameat unlinkat > full_audit:failure = none > full_audit:prefix = %u|%I > > but I can not find the related log about the missing directory. > normally I can find deleted/renamed files via the log. I wonder if > there is some other vfs operations I should add for monitor > directories? > > thanks a lot for your help!Is your question, what full_audit property to add to see a missing directory? What exactly do you want to see, the deletion or? a failing call that tries to read it or something else?>