diff -ruN e-smith-samba-2.2.0.old/createlinks e-smith-samba-2.2.0/createlinks
--- e-smith-samba-2.2.0.old/createlinks	2013-01-22 03:06:58.000000000 +0000
+++ e-smith-samba-2.2.0/createlinks	2013-01-22 05:18:59.000000000 +0000
@@ -24,6 +24,7 @@
 
 foreach my $file (qw(
 	/etc/pam.d/samba
+    /etc/logrotate.d/samba_audit
 	))
 {
     templates2events($file, qw(console-save bootstrap-console-save));
diff -ruN e-smith-samba-2.2.0.old/root/etc/e-smith/templates/etc/logrotate.d/samba_audit e-smith-samba-2.2.0/root/etc/e-smith/templates/etc/logrotate.d/samba_audit
--- e-smith-samba-2.2.0.old/root/etc/e-smith/templates/etc/logrotate.d/samba_audit	1970-01-01 01:00:00.000000000 +0100
+++ e-smith-samba-2.2.0/root/etc/e-smith/templates/etc/logrotate.d/samba_audit	2013-01-22 05:14:47.000000000 +0000
@@ -0,0 +1,11 @@
+/var/log/samba/samba_audit \{
+   weekly
+   missingok
+   rotate 7
+   postrotate
+      /etc/init.d/syslog reload > /dev/null 2>&1 || true
+   endscript
+   compress
+   notifempty
+\}
+
diff -ruN e-smith-samba-2.2.0.old/root/etc/e-smith/templates/etc/smb.conf/ibays/10smbaudit e-smith-samba-2.2.0/root/etc/e-smith/templates/etc/smb.conf/ibays/10smbaudit
--- e-smith-samba-2.2.0.old/root/etc/e-smith/templates/etc/smb.conf/ibays/10smbaudit	1970-01-01 01:00:00.000000000 +0100
+++ e-smith-samba-2.2.0/root/etc/e-smith/templates/etc/smb.conf/ibays/10smbaudit	2013-01-22 05:14:47.000000000 +0000
@@ -0,0 +1,12 @@
+{
+    $OUT = "";
+    return unless (($ibay->prop('Audit') || 'disabled') eq 'enabled');
+
+    $ibay_vfs->{full_audit}->{prefix} = "%u|%I|%S";                                                   
+    $ibay_vfs->{full_audit}->{failure} = "connect";
+    $ibay_vfs->{full_audit}->{success} = "opendir mkdir rmdir open write rename unlink";   
+    $ibay_vfs->{full_audit}->{facility} = "local5";
+    $ibay_vfs->{full_audit}->{priority} = "notice";
+}
+ 
+
diff -ruN e-smith-samba-2.2.0.old/root/etc/e-smith/templates/etc/syslog.conf/local5.notice e-smith-samba-2.2.0/root/etc/e-smith/templates/etc/syslog.conf/local5.notice
--- e-smith-samba-2.2.0.old/root/etc/e-smith/templates/etc/syslog.conf/local5.notice	1970-01-01 01:00:00.000000000 +0100
+++ e-smith-samba-2.2.0/root/etc/e-smith/templates/etc/syslog.conf/local5.notice	2013-01-22 05:26:34.000000000 +0000
@@ -0,0 +1 @@
+local5.notice			-{ "/var/log/samba/samba_audit" }