# set to log samba vfs audit module
local7.* /var/log/samba/audit.log