Check out http://www.reac.com/samba/samba-audit.html Phil Cox wrote: > logged in the log files by default. All suscessful connections are. Is > there a reason I have to have a debug level of 3 to get this (and MUCH MUCH > more). > > Is there a problem with having the failed authentication attempts at the > default logging level?