verify that the full_audit module is available: ls /usr/lib64/samba/vfs/full_audit.so or ls /usr/lib/samba/vfs/full_audit.so in the syslog config file (/etc/rsyslogd.conf on CentOS): --- local6.* /var/log/samba/log.audit --- Note: "local6" is a local facility name. These are named local1 through local7; you can choose any of these that isn't in use already. in the share definition in smb.conf: --- [someshare] #... vfs objects = full_audit full_audit:prefix = %u|%I|%m|%S full_audit:success = mkdir rename unlink rmdir write pwrite read pread full_audit:failure = none full_audit:facility = local6 full_audit:priority = NOTICE ---