verify that the full_audit module is available:
ls /usr/lib64/samba/vfs/full_audit.so
or
ls /usr/lib/samba/vfs/full_audit.so

in the syslog config file (/etc/rsyslogd.conf on CentOS):
---
local6.*   /var/log/samba/log.audit
---

Note: "local6" is a local facility name. These are named local1 through
local7; you can choose any of these that isn't in use already.


in the share definition in smb.conf:
---
[someshare]
		#...
        vfs objects = full_audit
        full_audit:prefix = %u|%I|%m|%S
        full_audit:success = mkdir rename unlink rmdir write pwrite read pread
        full_audit:failure = none
        full_audit:facility = local6
        full_audit:priority = NOTICE
---