[Samba] How to Separate Log Files via 'logging' Statement?

[Mike Ruebner]

Hi,

For starters I would like to send 'auth_audit:3' output to a separate log 
file than general debug messages, which should go to 'system.log'. I went 
through several iterations with the 'logging' switch, but none of them 
appears to work. The best I could come up with so far is 'logging = syslog' 
with 'log level = 1 auth_audit:3'. This sends messages with the required log 
level to rsyslogd, where I filter for auth messages. Everything else ends up 
in syslog. I am not even sure whether this is supposed to work as 'testparm' 
ignores the 'log level' settings.

Is there a comprehensive way to achieve this by 'logging' settings only? If 
yes, what's the correct syntax?

Samba AD DC v. 4.9.5-Debian

Any pointers greatly appreciated!

Mike