Hi, I'm currently running Samba 3.0.22 (on an Ubuntu 6.06 [Dapper] server). I have VFS full_audit set up successfully to log user activity using the LOCAL6 facility. I also have syslog configured to redirect all messages from this facility to /var/log/samba/log.audit This is working fine. However, I've recently been getting lines in /var/log/syslog that look like they're coming from full_audit. They all look something like this: Nov 29 10:12:07 SERVERNAME smbd[3312]: root|xxx.xxx.xxx.xxx|<machineName>|<shareName>|realpath|ok|<sharePath> Nov 29 10:12:07 SERVERNAME smbd[3312]: <userName>|xxx.xxx.xxx.xxx|<machineName>|<shareName>|realpath|ok|<sharePath> I can't for the life of me work out why these are appearing in the syslog. The same lines also appear in samba/log.audit along with all the other activity logs. My smb.conf has this configured: full_audit:prefix = %u|%I|%m|%S full_audit:success = mkdir rename unlink rmdir pwrite full_audit:failure = none full_audit:facility = LOCAL6 full_audit:priority = NOTICE ...and I have the line "vfs objects = full_audit" added to each of my share definitions. Can anyone suggest how I can stop these lines appearing in syslog please? - They're clogging up my logs and making it difficult to debug other processes. Thanks, -- Luke -- Luke