4 weeks ago
We have FPolicy configured on an SMB share, registered for open and read operations (no filter). On copying a file from one directory to another in the same share, we were expecting NetApp to send SMB_OPEN and SMB_RD notifications for that file to our fpolicy server. This happens as expected for small files (28 KB), however in case of larger files (1 MB and above), NetApp only sends SMB_OPEN.. no SMB_RD is generated for that file, even though the file is read and copied over to the target directory.
Is this some kind of an optimization by design? Is there a way to enable SMB_RD notifications in the above scenario?
Here's another data point - on copying the same 1 MB file to a location outside the share, SMB_OPEN and SMB_RD notifications are generated as expected.