July 16Jul 16 Hello happy people. I am looking into the OpenCanary app on Unraid and I want to monitor a specific SMB share so I get alerts if anything changes something in that share. What I ultimately want is a process that stops the array if the honeypot is engaged in case of ransomware. Reading up on setup, I notice that a key part of the configuration is full_audit in the SMB config. Per the OpenCanary setup for SMB ... vfs object = full_audit full_audit:prefix = %U|%I|%i|%m|%S|%L|%R|%a|%T|%D full_audit:success = flistxattr full_audit:failure = none full_audit:facility = local7 full_audit:priority = noticeI am wondering if this would be a logging nightmare that causes server crashes?
July 24Jul 24 snake gameOn 7/16/2026 at 8:18 PM, rdagitz said:Hello happy people. I am looking into the OpenCanary app on Unraid and I want to monitor a specific SMB share so I get alerts if anything changes something in that share. What I ultimately want is a process that stops the array if the honeypot is engaged in case of ransomware. Reading up on setup, I notice that a key part of the configuration is full_audit in the SMB config. Per the OpenCanary setup for SMB ... vfs object = full_audit full_audit:prefix = %U|%I|%i|%m|%S|%L|%R|%a|%T|%D full_audit:success = flistxattr full_audit:failure = none full_audit:facility = local7 full_audit:priority = notice I’ve experimented with Samba auditing in production-like environments, and the usual problem is not the CPU load—it’s the amount of noise generated when auditing too many operations. If you changed full_audit:success to include things like open, write, rename, and unlink, then yes, a busy SMB share could generate a ridiculous amount of logs.
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.
Note: Your post will require moderator approval before it will be visible.