[Samba] using vfs module full_audit: longer history?

[Stefan G. Weichinger]

Am 23.09.19 um 14:52 schrieb Stefan G. Weichinger via samba:
> Am 23.09.19 um 12:29 schrieb Stefan G. Weichinger via samba:
>>
>> A customer asked "who deleted file X?"  and I noticed that my current
>> setup only gives me about 4 days of log history ...
>>
>> Debian uses systemd which runs journald, so I know to use journald.conf
>> to increase the log file size etc
>>
>> Any way to specifically increase only the history size for that auditing
>> module (and not for all the other systemd units)?
> 
> on my way there with some rsyslog-filtering.

Is it possible to write one audit-file per share?