July 16Jul 16 Hello happy people. I am looking into the OpenCanary app on Unraid and I want to monitor a specific SMB share so I get alerts if anything changes something in that share. What I ultimately want is a process that stops the array if the honeypot is engaged in case of ransomware. Reading up on setup, I notice that a key part of the configuration is full_audit in the SMB config. Per the OpenCanary setup for SMB ... vfs object = full_audit full_audit:prefix = %U|%I|%i|%m|%S|%L|%R|%a|%T|%D full_audit:success = flistxattr full_audit:failure = none full_audit:facility = local7 full_audit:priority = noticeI am wondering if this would be a logging nightmare that causes server crashes?
July 24Jul 24 snake gameOn 7/16/2026 at 8:18 PM, rdagitz said:Hello happy people. I am looking into the OpenCanary app on Unraid and I want to monitor a specific SMB share so I get alerts if anything changes something in that share. What I ultimately want is a process that stops the array if the honeypot is engaged in case of ransomware. Reading up on setup, I notice that a key part of the configuration is full_audit in the SMB config. Per the OpenCanary setup for SMB ... vfs object = full_audit full_audit:prefix = %U|%I|%i|%m|%S|%L|%R|%a|%T|%D full_audit:success = flistxattr full_audit:failure = none full_audit:facility = local7 full_audit:priority = notice I’ve experimented with Samba auditing in production-like environments, and the usual problem is not the CPU load—it’s the amount of noise generated when auditing too many operations. If you changed full_audit:success to include things like open, write, rename, and unlink, then yes, a busy SMB share could generate a ridiculous amount of logs.
August 18Aug 18 On 7/16/2026 at 8:18 PM, rdagitz said:Hello happy people. I am looking into the OpenCanary app on Unraid and I want to monitor a specific SMB share so I get alerts if anything changes something in that share. What I ultimately want is a process that stops the array if the honeypot is engaged in case of ransomware. Reading up on setup, I notice that a key part of the configuration is full_audit in the SMB config. Per the OpenCanary setup for SMB ... stickman hook vfs object = full_audit full_audit:prefix = %U|%I|%i|%m|%S|%L|%R|%a|%T|%D full_audit:success = flistxattr full_audit:failure = none full_audit:facility = local7 full_audit:priority = noticeI am wondering if this would be a logging nightmare that causes server crashes?Using full_audit can generate a lot of logs, which might impact server performance. To avoid crashes, consider setting up log rotation and filtering events to only log critical actions. Test the configuration before deploying it in production.
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.
Note: Your post will require moderator approval before it will be visible.