With this configuration : full_audit:prefix = %I|%m|%U full_audit:success = mkdir rmdir open close write pwrite sendfile rename unlink utime ftruncate symlink link full_audit:failure = opendir readdir seekdir telldir rewinddir mkdir rmdir closedir open close read pread write pwrite lseek sendfile rename fsync unlinkchmod fchmod chown fchown chdir getwd utime ftruncate lock symlink readlink link mknod realpath It generates log entries like this: Mar 15 12:59:46 servername smbd_audit: clientip|clientname|clientuser|stat| fail (No such file or directory)|path/to/a/directory/* May have something to do with the array vfs_op_names in the file source/modules/vfs_full_audit.c. Operations don't seem to match the order of vfs_ops in source/include/vfs.h.
Created attachment 1035 [details] Fix I applied. Fix I applied.
I think the applied patch fixes the problem. Please re-open if not. Jeremy.
sorry for the same, cleaning up the database to prevent unecessary reopens of bugs.