[Samba] Samba audit

[Andrea Cucciarre']

Hello,

My goal is to audit allowed or denied access to files and directories in 
the share.
I'm trying to use vfs_full_audit and vfs_audit, to audit all the access 
(allowed or denied) to files and directory.
The smb.conf entry for my share are the following:

[test_link]
available = yes
browsable = yes
hf:volume = test_link
nfs4: acedup = merge
nfs4: mode = special
path = /test_link
read only = no
vfs objects = hf_vss hf_offline zfsacl audit
wide links = yes
dfree command = /ovmh/bin/dfree
audit:facility = LOCAL7
audit:priority = ALERT

I have also tried the vfs_full_audit, same config as the example in:


https://www.samba.org/samba/docs/current/man-html/vfs_full_audit.8.html

I have verified that my syslogd accept and log local7.alert event.
However, I don't get any audit log when windows client access the files 
in the share.
Could you please advice how to configure such auditing in Samba, or how 
to further investigate why my config is not working?

-- 

Regards
Andrea Cucciarre'