Hello. FreeBSD 10.1 Samba 4.2.2 (also reproduced in 4.1.17, 4.1.18). In vfs_audit log there is problem with filenames, foldernames in russian. For example: Jun 17 12:52:46 aus smbd_audit: 192.168.1.38|dron|mkdir|ok|MyDoc/.M-^]ова.M-^O папка Jun 17 12:53:32 aus smbd_audit: 192.168.1.38|dron|unlink|ok|MyDoc/.M-^]ова.M-^O папка/Тек.M-^A.M-^Bов.M-^Kй док.M-^Cмен.M-^B.txt Jun 17 12:53:46 aus smbd_audit: 192.168.1.38|dron|rmdir|ok|MyDoc/.M-^]ова.M-^O папка So MyDoc/.M-^]ова.M-^O папка shall be MyDoc/Новая папка and MyDoc/.M-^]ова.M-^O папка/Тек.M-^A.M-^Bов.M-^Kй док.M-^Cмен.M-^B.txt shall be MyDoc/Новая папка/Текстовый документ.txt unix cahrset is utf-8 and locale also utf-8.
Hello! Any updates about this issue?
Hello. Any news? It's become critical.
vfs_audit writes the log messages including the file names to the syslog daemon. It's up to the daemon to write them into the log files correctly and up to your terminal program (and the locale settings) etc to display it to you in the correct way. I think I heard about some syslog implementations not dealing nicely with messages including characters > ascii code 127. But as the log file seems to contain other unicode characters, that might not be the root cause here. From looking at the snippets you pasted, it seems that the problematic characters are uppercase. Do they have a a special encoding in UTF8? You might also want to sniff the packets to the syslog daemon (e.g. by setting up a log forwarding to another host and then sniffing on the external interface). If you examine the sniff and see that Samba send the filenames correctly, then it is a problem with your syslog or terminal.
It is FreeBSD syslogd related. Workaround is to start syslog with -8 parameter according to https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=129248 Works for me.