Hello Samba Team, First of all, thank you all for the great work on Samba! <3 I recently faced something that I believe is a bug. After reading the documentation for the vfs_full_audit module and configuring it, all SMB connections to the configured share started to fail with "System Error 59" on Windows clients. The parameters that cause this issue are full_audit:success and full_audit:failure. Any attempt to define a list of operations for these parameters resulted in the share becoming unreachable. The key evidence from the client-specific log file (with log level = 3) shows that the module cannot find the operation names: [2025/06/27 14:16:41.375158, 0] ../../source3/modules/vfs_full_audit.c:566(init_bitmap) init_bitmap: Could not find opname mkdir [2025/06/27 14:16:41.375202, 0] ../../source3/modules/vfs_full_audit.c:755(smb_full_audit_connect) smb_full_audit_connect: Invalid success operations list. Failing connect We have already verified that this is not caused by rsyslog (it is running correctly), file permissions, or AppArmor denials. The issue seems to be exclusively within the vfs_full_audit module's handling of operation names. Successful Workaround: The share works flawlessly as soon as I remove the full_audit:success and full_audit:failure lines. The module then logs all operations, which is functional but very verbose (the log is a little bit "ugly," but that's fine for me as a workaround). It seems the operation name map in this version of the module is faulty, making selective auditing impossible. Thank you for looking into this. Edit: I Reseached some of the Older Bugs regarding VFS Full Audit and found #14324. So this appears to be a regression or a very similar issue to Bug #14324, which affected Samba 4.12. The symptoms and the root cause (name table out of sync, proven by the 'Could not find opname' error) are nearly identical. Best regards, Felix Reichart
Use the source: <https://git.samba.org/?p=samba.git;a=blob;f=source3/modules/vfs_full_audit.c;h=25fd0cad326f8a991e5e5a23b40ed21a9f28b9aa;hb=refs/heads/v4-17-stable#l237> Unfortunately the manpages haven't been updated when VFS changed. A patch that updates the manpages to match the code for current versions if needed would be very much welcomed!
(In reply to Ralph Böhme from comment #1) thanks for the quick analysis and the clear direction. I'm currently blocked by an unrelated networking issue. As soon as my Environment is stable, I will verify your suggested fix. I'd be happy to prepare the Patch for the manpage update afterwards and will attach it here. It might take one or two weeks due to my upcoming vacation, but I will definitely follow up on this. Best regards Felix