verify that the full_audit module is available:
ls /usr/lib64/samba/vfs/
ls /usr/lib/samba/vfs/

in the syslog config file (/etc/rsyslogd.conf on CentOS):
local6.*   /var/log/samba/log.audit

Note: "local6" is a local facility name. These are named local1 through
local7; you can choose any of these that isn't in use already.

in the share definition in smb.conf:
        vfs objects = full_audit
        full_audit:prefix = %u|%I|%m|%S
        full_audit:success = mkdir rename unlink rmdir write pwrite read pread
        full_audit:failure = none
        full_audit:facility = local6
        full_audit:priority = NOTICE