Daniel Niasoff schrieb: > > When auditing with VFS the pathname recorded is only the relative path for > the share not the the full path all the way from root.
int audit_close(struct files_struct *fsp, int fd) [..] fstrcpy(fname, fsp->conn->connectpath); fstrcat(fname, "/"); fstrcat(fname, fsp->fsp_name); [..] Should work. HTH best regards, Rainer Link -- Rainer Link | Student of Computer Networking [EMAIL PROTECTED] | University of Applied Sciences, Furtwangen, Germany rainer.w3.to | http://www.computer-networking.de/