Hi,
With smb.conf having full_audit and recycle, today I saw:
Sep 17 10:48:49 kantoor smbd_audit[2317861]:
hannah|192.168.1.26|ashare|unlinkat|ok|/home/ashare/Documents/20240917Workflow.ods
However, there's no /home/.recycle/hannah/Documents/ or any other hint
of 20240917Workflow.ods in her recycle directory. As there is a copy of
the last version of this file (in another users directory) which has a
file size of 42266 bytes, I can't think of the 1023 size limit being in
action here.
But then: how can an unlinked file not end up in the recycle directory?
smb.conf excerpt:
full_audit:prefix = %u|%I|%S
full_audit:failure = connect
full_audit:success = connect disconnect mkdirat open openat
create_file close read pread pread_recv write pwrite pwrite_send
sendfile renameat unlinkat ftruncate
full_audit:facility = local5
full_audit:priority = notice
recycle:minsize = 1023
recycle:repository = /home/.recycle/%U
recycle:keeptree = yes
recycle:versions = yes
[ashare]
vfs objects = fruit streams_xattr full_audit recycle
Anyone any idea? This is with an older version of Samba, Ubuntu version
2:4.15.13+dfsg-0ubuntu0.20.04.7
Best regards,
Valentijn