snake game I’ve experimented with Samba auditing in production-like environments, and the usual problem is not the CPU load—it’s the amount of noise generated when auditing too many operations. If you changed full_audit:success to include things like open, write, rename, and unlink, then yes, a busy SMB share could generate a ridiculous amount of logs.