FreeNAS 11.3, SMB domain share and file auditing. How to implement the latter?

Question

Samba

Good day.
A small company uses a domain network from a single domain. The FreeNAS 11.3 fileserver has been successfully added to the domain, the pool is shared as SMB.
To organize access rights to directories, the following was done: free access was opened from under FreeNAS, all Unix users and groups from access rights to the share were removed from under Windows, the owner was changed to Windows admin, and new rights were assigned to different Windows directories to users . (In earlier versions, FreeNAS picked up groups and domain users directly from the FreeNAS interface. That is, I could select a Windows domain user from the drop-down list in the list of rights to the directory. In this version, I could not achieve such a result).
In general, now the task is to control changes in files and directories on this very ball. Tried through audit, but it did not turn out. At the stage of adding an audit to any folder of this share, the parameters are applied to files, but the audit entry itself does not appear in the properties window. While on any other shared windows folder, this method works.
How can something similar be achieved? Alternatively, maybe you can write to the FreeNAS log? The main thing is to have data: who, when and what did with the file / folder.

Answer 1

Based on proconfig.ru/2018/05/samba-audit-detailed-log
FreeNAS version 11.1-U7.
Open the FreeNAS web interface.
Services - SMB service settings:
In the "Additional parameters" field, add:

full_audit:prefix = %S | %u | %m |
full_audit:failure = none
full_audit:success = rmdir unlink
full_audit:facility = local5
full_audit:priority = notice

Further. Sharing - Windows (SMB) - share properties:
In advanced mode, add the "full_audit" VFS object with an arrow in the right column.
To move the audit to a separate file without duplication in /var/log/messages, you need to go to the beginning of the /conf/base/etc/local/syslog-ng.conf.freenas file after the first line (I have the first line - "@version:3.7" ) insert the following lines:

destination m_samba_audit { file("/mnt/data/audit.log"); };
log { source(src); filter(f_local5); destination(m_samba_audit); flags(final); };