I managed to record the logs using the vfs objects = full_audit in [global] smb.conf the primary DC. But still can not see the time that you held logon and logoff.