[Samba] Problems with the Full Audit module

[Rowland Penny]

On Fri, 28 Apr 2017 15:38:46 +0000 (UTC)
Ricardo Pardim Claus via samba <samba at lists.samba.org> wrote:

> > It should work, have you tried changing the order, or just using
> > full_audit ?
> 
> 
> I have enabled the line below: 
> Vfs objects = acl_xattr 
> 
> I disabled all other modules, I just left full_audit. 
> 
> The problem is even when I leave only the full_audit enabled.

About the only thing I can see wrong (and this is clutching at
straws), you have:

full_audit:facility = local1

Try changing it to:

full_audit:facility = LOCAL1

You should also raise the log level to 10 and see if anything pops out
in the logs.

Rowland