In source3/modules/vfs_full_audit.c there is this code: 575 if (i == SMB_VFS_OP_LAST) { 576 DEBUG(0, ("Could not find opname %s, logging all\n", 577 *ops)); 578 TALLOC_FREE(bm); 579 return NULL; 580 } If it does not find the op in the list it will fall back to log everything. The only way how to find out is to have enabled 'all' 'log level'. Otherwise smbd will silently start logging everything and fill logs. Could this be changed to something that will skip the operation, leave the message in the log (or dies), but will do its job as good as possible, please?