SMB Audit Logs Randomly Missing Delete Events on a Busy TrueNAS Server

TrueNAS General
,
1

Hi Experts,

I’m running into a strange issue with SMB auditing on TrueNAS and hoping someone can shed some light on it.

Environment:

  • 25.10.1 - Goldeye

  • SMB share with auditing enabled (audit enabled on the share)

  • This is a very busy production SMB server with heavy concurrent I/O from many clients

  • The audit database (SQLite, /audit/SMB.db) has grown to over 700 GB

The Problem:

We recently needed to investigate several file deletion incidents. When querying the audit database, we found that some delete operations were never recorded — the corresponding UNLINK events simply don’t exist in the database. Other delete events around the same time period were logged correctly, so auditing itself is clearly working, just not reliably.

To rule out user error, I tested this myself: I manually deleted test files on the share several times, and I was able to reproduce the issue — some of my own delete operations showed up in the audit DB, while others were silently missing. This seems random and intermittent.

Example query I’m using:

echo “select * from audit_SMB_0_1 where success=1 and event =‘UNLINK’;” | sqlite3 SMB.db > 1.log

My questions:

  1. Is there any known mechanism where audit events can be dropped under heavy load? (e.g., a ring buffer / message queue between smbd and the audit daemon that overflows and silently discards events?)

  2. Could the 700+ GB database size itself be the problem — e.g., SQLite write contention, lock timeouts, or slow inserts causing events to be dropped rather than queued?

  3. Is there a queue depth / buffer size tunable for the SMB audit subsystem

  4. Are dropped audit events logged anywhere else (syslog, middlewared logs, /var/log/) so I can confirm whether events are being discarded?

Any insight would be greatly appreciated.

Thanks in advance!