Windows 10 and full_audit SMB module

[milancesal]

I'm using FreeNAS 11 (STABLE).

When you enable "full_audit" vfs module for a SMB share, you get a warning message:

"full_audit VFS object is known to have file transfer issues with Windows 10. Do you wish to continue?"

The latest document of FreeNAS 11.1-RC1 says:

"full_audit - record selected client operations to the system log; if selected, a warning will indicate that Windows 10 clients may experience issues when transferring files to the NAS system when this module is enabled"

This problem hasn't been fixed yet? Or is it just the documentation that hasn't been updated yet?

I haven't tested it with Windows 10 yet, but can anyone clarify this?

One more question. If "full_audit" module still has this problem, then what about just the "audit" module which has limited features in setting options? Otherwise, these two different modules share the same code underneath and they both have this problem?

 

[anodos]

There is no real problem with Windows 10 and full audit... but you need to configure the module to only log the VFS operations that you need to log (success and failure) otherwise you will bring your server to its knees.

 

[milancesal]

There is no real problem with Windows 10 and full audit... but you need to configure the module to only log the VFS operations that you need to log (success and failure) otherwise you will bring your server to its knees.

Yes! I have identified that problem. Not because of Windows 10 (Win7 used), but the amount of logs that are pushed through that vfs module. I included "aio_write" operation and then it produced lots of log entries. This happens to be logging all operations that pass through some 'queue'. SMB daemon doesn't get crashed. It's just that 'logging' doesn't work when this happens.

However, Windows File Explorer gets crashed on my Windows 7 when I attempt to create a folder in a share. It crashes once and then Explorer gets restarted. Then I try to create a folder again and it crashes again or sometimes it just works from then.

This vfs module "full_audit" (may include 2 other auditing modules "audit" and "extd_audit") seems to have a lot of bugs unfixed. The documentation is pretty bad as well. I cannot even find the correct list of 'operations' that can be set in config. All outdated everywhere. The more I test it, the more I feel insecure using it. I wonder how this module will affect on the overall performance of FreeNAS. The FreeNAS documentation does say "disable all vfs modules" for the best.

There seems to be no alternative at the moment unless you write a better vfs module yourself. You could use auditing feature of FreeBSD or use some other 'file system monitor and log' tool, but most importantly you need SMB "username" in your logs. Samba daemon is the only one that knows usernames in all cases.

Anyone has a better solution?