Can't get vfs objects full_audit to write to separate file

Hello,

I'm desperately trying to get Samba to write SMB auditing to a separate logfile. Under Settings --> SMB --> Samba Extra Configuration, the following already outputs Samba logs in general to it's own file and writes additional full_audit information:

logging = file
log file = /var/log/samba/samba.log
log level = 3 winbind:0
vfs objects = full_audit
full_audit:prefix = %u|%I|%S
full_audit:priority = NOTICE
full_audit:success = openat mkdirat renameat unlinkat pwrite
full_audit:failure = openat

(The winbind:0 suppresses annoying errors that spammed my logs.)

So according to the smb.conf Man page, I can direct different objects to separate files with different log levels, so I tried:

logging = file
log file = /var/log/samba/samba.log
log level = 3 winbind:1@/var/log/samba/winbind.log full_audit:5@/var/log/samba/audit.log
vfs objects = full_audit
full_audit:prefix = %u|%I|%S
full_audit:priority = NOTICE
full_audit:success = openat mkdirat renameat unlinkat pwrite
full_audit:failure = openat

(And I tried many different combinations of log levels, orders of these commands, ...)

But this only generates an audit.log file, but the full_audits go nowhere. The file stays empty.

winbind.log on the other hand gets populated with the errors I directed to that file...!

I'm a bit lost right now, so if anybody could point me in the right direction, I would be very thankful.

Edited April 4, 20242 yr by adrifromhh