0

We have a TrueNAS System running TrueNAS-12.0-U8 for which we are required to log all successful and all failed file access attempts for a specific SMB share. The Samba version is 4.13.

Per guidance from the vendor, I've included the below in the auxiliary parameters for the share with the logging requirements. This appears to satisfy my requirement based on my testing.

vfs objects = full_audit streams_xattr aio_fbsd ixnas
full_audit:prefix = %u|%I|%S
full_audit:priority = notice
full_audit:success = openat
full_audit:failure = openat

I am interested in better understanding all of the VFS operations but have been unable to find a resource that includes definitions. Most of the operations I can find in documentation such as the Arch Linux VFS Full Audit are self explanatory but others are not.

Can anyone suggest a resource that includes definitions of the VFS operations?

1 Answer 1

0

The main ones we use are: openat - although can be quite chatty mkdirat renameat unlinkat

https://www.samba.org/samba/docs/current/man-html/vfs_full_audit.8.html

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .