# use the vfs full audit module
# see https://moiristo.wordpress.com/2009/08/10/samba-logging-user-activity/
# https://www.samba.org/samba/docs/man/manpages-3/vfs_full_audit.8.html
vfs objects = full_audit

# Username | machine name | name of service
vfs_full_audit:prefix = %U|%m|%S

## log the following functions
## create a directory, rename something, delete (unlink) a file, rm a directroy
## read/write a file, open a file
full_audit:success = mkdir rename unlink rmdir pwrite open rmdir pread
# rename open !strict_unlock !pread !get_alloc_size !readdir !telldir !lstat !closedir !connectpath !opendir

## Do not log anything on failure
full_audit:failure = none

## use syslog local7 for the logs
## you must create this in syslog.conf by adding a line
## local7.* /var/log/samba/log.audit
## and also set logrotate
full_audit:facility = local7

## all set to NOTICE
full_audit:priority = NOTICE