Samba Auditing

[Flupp]

A while back I was looking into getting samba logs out of TrueNAS via syslog and fed to my Graylog server. What I want to be able to do is log:

- File & Folder Creation / Deletion / Modification
- File & Folder Access

I managed to partially get to where I want to be with the following Aux Params

vfs objects=full_audit ixnas zfs_core aio_fbsd catia fruit streams_xattr
full_audit:prefix=%u|%I|%m
full_audit:priority=notice
full_audit:success=mkdirat renameat unlinkat disconnect
full_audit:facility = LOCAL7

From a folder perspective, this works fine. But as far as files go it still doesn't log the creation of new files or if the content gets edited. Also still can't generate logs on file/folder access.

I tried a bunch of different options from the samba docs here with no luck. Some of these seem to not do anything, and the ones that do something generate tons of noise.

Would appreciate any help on this :)