I reopen my Scale test VM and I make some new tests.
I removed the line log level = 5
I just keep these command
vfs objects = full_audit ixnas
full_audit:prefix = %u|%I|%m|%f
full_audit:success = mkdirat renameat unlinkat openat rmdir writeat
full_audit:failure = none
full_audit:facility = local7
full_audit:priority = NOTICE
Here the result when I add files in the share
Message : 29322 - - @cee:{“TNAUDIT”: {“success”: true, “aid”: “bd764e71-96a7-471b-867c-5aae18c0ea2a”, “vers”: {“major”: 0, “minor”: 1}, “addr”: “10.101.30.72”, “user”: “smb_user”, “sess”: “36e552c7-edf1-44ed-b417-233562e8eaa7”, “time”: “2024-12-11 13:23:47.021238Z”, “svc”: “SMB”, “svc_data”: “{"vers": {"major": 0, "minor": 1}, "service": "Testfiles", "session_id": "1856527050", "tcon_id": "3905207551"}”, “event”: “CREATE”, “event_data”: “{"parameters": {"DesiredAccess": "0x0017019f", "FileAttributes": "0x00000020", "ShareAccess": "0x00000000", "CreateDisposition": "CREATE", "CreateOptions": "0x00000044"}, "file_type": "FILE", "file": {"path": "AnywhereUSB_Chubb/Outil_Discovery_40002256_H.exe", "stream": null, "snap": null, "handle": {"type": "DEV_INO", "value": "54:31:0"}}, "result": {"type": "NTSTATUS", "value_raw": 0, "value_parsed": "SUCCESS"}, "vers": {"major": 0, "minor": 1}}”}}
When I removed file from the share
Message : 29322 - - @cee:{“TNAUDIT”: {“success”: true, “aid”: “922a790c-e861-44b8-9ab7-8a5a3c453648”, “vers”: {“major”: 0, “minor”: 1}, “addr”: “10.101.30.72”, “user”: “smb_user”, “sess”: “36e552c7-edf1-44ed-b417-233562e8eaa7”, “time”: “2024-12-11 13:31:17.496251Z”, “svc”: “SMB”, “svc_data”: “{"vers": {"major": 0, "minor": 1}, "service": "Testfiles", "session_id": "1856527050", "tcon_id": "3905207551"}”, “event”: “CLOSE”, “event_data”: “{"file": {"path": "PRTG v2.1.pptx", "stream": null, "snap": null, "handle": {"type": "DEV_INO", "value": "54:25:0"}}, "operations": {"read_cnt": "1", "read_bytes": "4096", "write_cnt": "0", "write_bytes": "0"}, "result": {"type": "UNIX", "value_raw": 0, "value_parsed": "SUCCESS"}, "vers": {"major": 0, "minor": 1}}”}}
Time : 2024-12-11 08:31:17DisplayName : 10.50.105.31Device : 10.50.105.31Severity : noticeFacility : UserSource : smbd_auditUsername : -Remote Device : -LogonId : -Audit Id : -Logon Type : -Target Domain : -Target User : -User Pid : -Target Group : -Group Id : -LogType : UnixFile Type : -File Size : -Target Device : -Error Code : -Status : -Event Name : -Usertest : -Usertest2 :
When I open a file from TrueNAs Scale and I closed it after
Message : 29322 - - smb_user closed file pdf24_merged.pdf (numopen=3) NT_STATUS_OK
Time : 2024-12-11 08:34:58DisplayName : 10.50.105.31Device : 10.50.105.31Severity : noticeFacility : DaemonSource : smbd_auditUsername : -Remote Device : -LogonId : -Audit Id : -Logon Type : -Target Domain : -Target User : -User Pid : -Target Group : -Group Id : -LogType : UnixFile Type : -File Size : -Target Device : -Error Code : -Status : -Event Name : -Usertest : -Usertest2
I think I’m near to find the good command to have what I need