TrueNAS auditing and logs provide a trail of all actions performed by a session, user, or service (SMB, middleware).

The audit function backends are the syslog and Samba debug libraries. Syslog sends audit messages via an explicit syslog call with configurable priority (WARNING is the default) and facility (for example, USER). The default is syslog-sent audit messages. Debug sends audit messages from the Samba debug library. Messages have a configurable severity (WARNING, NOTICE, or INFO).

TrueNAS auditing logs record all operations performed by a session, user, or service (SMB, middleware).

The Audit screen lists all session or user events, facilitating comprehensive monitoring.