title: Monitoring Samba Activity with Full_Audit
body: <p>I have samba server. I've configured smb.conf like this:</p>
  
  <pre><code>[global]
  # Another configuration
  #
  #
  
  # Audit Activity Settings
  full_audit:prefix = %u|%I|%m|%S
  full_audit:success = mkdir rename unlink rmdir pwrite pread
  full_audit:failure = none
  full_audit:facility = local7
  full_audit:priority = NOTICE
  
  [shared]
  comment = Shared Content 
  path = /data/shared
  read only = no
  browsable = yes
  vfs objects = full_audit
  </code></pre>
  
  <p>I want to throw samba log to specific file, for example to <code>/var/log/samba/log.audit</code>. I've configured in rsyslog.conf like this:</p>
  
  <pre><code>if $syslogfacility-text == 'local7' and $programname == 'smbd' then /var/log/samba/log.audit
  </code></pre>
  
  <p>but nothing happen, no file log log.audit at <code>/var/log/samba/</code>.</p>
  
  <p>And I have too try configured at <code>/etc/rsyslog.d/50-default.conf</code> like this:</p>
  
  <pre><code>local7.* /var/log/samba/log.audit
  </code></pre>
  
  <p>but same, no file log <code>log.audit</code> at <code>/var/log/samba/</code>.</p>
  
  <p>But, Full_Audit logs available at syslog:</p>
  
  <pre><code>Mar 20 02:49:26 media-arsip smbd_audit: content|192.168.84.69|ubspok18|shared|mkdir|ok|sharedcontent/ok/tes
  </code></pre>
  
  <p>How to throw that syslog samba full_audit logs to <code>/var/log/samba/log.audit</code> ?</p>