VFS\_AUDIT(8) System Administration tools VFS\_AUDIT(8)

# [NAME](#NAME)

vfs\_audit - record selected Samba VFS operations in the system log

# [SYNOPSIS](#SYNOPSIS)

.HP 24u

vfs objects = audit

# [DESCRIPTION](#DESCRIPTION)

.PP This VFS module is part of the [**samba**(7)](/man/os/samba/samba.7) suite.

.PP The vfs\_audit VFS module records selected client operations to the system log using [**syslog**(3)](/man/os/samba/syslog.3).

.PP The following Samba VFS operations are recorded:

.RS 4 connect

disconnect

opendir

mkdir

rmdir

open

close

rename

unlink

chmod

fchmod

.PP This module is stackable.

# [OPTIONS](#OPTIONS)

.PP audit:facility = FACILITY

Log messages to the named [**syslog**(3)](/man/os/samba/syslog.3) facility.

.RE

.PP audit:priority = PRIORITY

Log messages with the named [**syslog**(3)](/man/os/samba/syslog.3) priority.

.RE

# [EXAMPLES](#EXAMPLES)

.PP Log operations on all shares using the LOCAL1 facility and NOTICE priority:

```


        [global]
	vfs objects = audit
	audit:facility = LOCAL1
	audit:priority = NOTICE
```

# [VERSION](#VERSION)

.PP This man page is part of version 4.25.1 of the Samba suite.

# [AUTHOR](#AUTHOR)

.PP The original Samba software and related utilities were created by Andrew Tridgell. Samba is now developed by the Samba Team as an Open Source project similar to the way the Linux kernel is developed.

11/05/2026 Samba 4.25.1

---

Document: vfs_audit(8) from samba 4.25.1-r1 (Chainguard OS)
Source: https://github.com/samba-team/samba