Enabling Samba Audit on TrueNAS Scale 13

Hello everyone! I’m posting here because I have a need and would like to know if anyone in the group has implemented Samba audit on TrueNAS Scale 13.

I have a client who has “lost” files from the share twice already, and I can’t identify the culprit due to the lack of Samba auditing. Normally, on Samba, OpenMediaVault, and others, I would edit the smb.conf directly for this purpose, but on TrueNAS, I prefer to avoid making such changes. I wanted to know if anyone here has implemented this functionality and how.

My goal is not to send the logs to a Graylog or another remote log storage server. If I can create a log file in an existing Datastore (to avoid putting strain on the boot disk), that would be perfect for me.

I appreciate any tips you can provide.

this might help