It seems that FULL_AUDIT automatically uses the syslog facility, but I would rather it just wrote to a file in /var/log/samba/
I know how to configure syslog to do that, but I'd prefer to use the "log file" directive than syslog. No matter what I do it always seems use syslog.
I've a feeling this is hard-coded but hoping someone can help.
I have tried various flags, "syslog only", "logging = file", "log level = full_audit:3@/var/log/samba/full_audit" but none seem to work and full audit always go to syslog.