Understanding Samba VFS Operations for Full Audit

jp flag

We have a TrueNAS System running TrueNAS-12.0-U8 for which we are required to log all successful and all failed file access attempts for a specific SMB share. The Samba version is 4.13.

Per guidance from the vendor, I've included the below in the auxiliary parameters for the share with the logging requirements. This appears to satisfy my requirement based on my testing.

vfs objects = full_audit streams_xattr aio_fbsd ixnas
full_audit:prefix = %u|%I|%S
full_audit:priority = notice
full_audit:success = openat
full_audit:failure = openat

I am interested in better understanding all of the VFS operations but have been unable to find a resource that includes definitions. Most of the operations I can find in documentation such as the Arch Linux VFS Full Audit are self explanatory but others are not.

Can anyone suggest a resource that includes definitions of the VFS operations?

dm flag

The main ones we use are: openat - although can be quite chatty mkdirat renameat unlinkat

I sit in a Tesla and translated this thread with Ai:


Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.