Hi there,
I have add /etc/rsyslog.d/samba_audit.conf with the content
# set to log samba vfs audit module
local7.* /var/log/samba/audit.log
to get samba’s audit log in a separate file. That working but I have additional the logs in /var/log/messages and /var/log/syslog
How can I get away the audit logs from the both files?
In samba I use full_audit:priority=NOTICE and full_audit:facility=local7
Thanks for advice,
Frank