[Samba] eventlog functionality

[ray klassen]

we have recently purchased a security appliance that wants to poll the DC's for login info (ipaddress:logged-in-user) to give more granular access to internet resources
this seems possible with samba 4.8.4

my smb.conf

    log level = 1 auth_audit:3
    eventlog list = Application System Security SyslogLinux


It doesn't look like audit events are ending up in
/usr/local/samba/var/locks/eventlog/security.tdb
which where they might go.
I certainly am seeing lots of login audit info in log.samba, so that's working. 

Any suggestions?