Samba logging problems write, pwrite, read, pread, rename what could be the problem?

Question

Samba

Hello
samaba 4.9.5

encountered the following problem:
write, pwrite, read, pread events are not written to the log, while all the rest have

the following config

[обменник1]
comment = share directory
inherit acls = yes
inherit owner = yes
path = /storage/Обменник1
inherit permissions = yes
hide unreadable = yes
writeable = yes
read only = no
browseable = yes
# guest ok = yes
valid users = samara, buzuluk, volgograd, krym, tolyatti, ulyanovsk, otradnyj, kogalym, mirniy, krasnodar, samaratc, crimeatc, moskva, nnovgorod, sevastopol, chelyabinsk,
vfs objects = recycle crossrename full_audit
full_audit:prefix: = %u|%I|%L|%m|%s
full_audit:success = connect, disconnect, mkdir, rmdir, read, pread, sendfile, write, rename, pwrite, fchown, chmod, fchmod
full_audit:failure = open, connect, disconnect, mkdir, rmdir, read, pread, sendfile, write, rename, pwrite, fchown, chmod, fchmod
full_audit:failure = none
full_audit:facility = local5
full_audit:priority = notice
recycle:repository = /storage/recycle/.recycle
btrfs: manipulate snapshots = no
recycle:exclude = *.tmp,*.temp,*.o,*.obj,~$*,*.~??,*.trace,*.VOB,*.mp4,*.avi,*.crdownload,~*,*TMP,*.iso,*.flv,*.webm,*.MOV,*.mpg,*.wmv,*.exe
recycle:excludedir = /tmp,/temp,/cache
recycle:keeptree = yes
recycle:touch = yes
recycle:touch_mtime = yes
recycle:versions = yes
recycle:maxsize = 0
recycle:directory_mode = 0777

/etc/rsyslog.conf
local5.notice -/var/log/samba/audit.log
What could be the problem?

Answer 1

Why do you have twice full_audit:failure?

Answer 2

If you use extd_audit, then all operations are visible, but there is no way to see on whose behalf these actions were performed, it turns out that the cant is only in full_audit, I looked at the changes in samba 4.9.5, they ruled vfs_full_audit from false positives, maybe this is the case?