It looks like vfs_audit and vfs_full_audit can only log to syslog.
On systems were journald is running it also keeps those entries in its ring-buffer. There is no way to disable this (you can only disable storing those entries to disk but that takes a big hammer).
It would be desirable to also allow logging to a file like we can with the normal 'log file' command.
I think this got fixed? Or atleast there is a patch for this at Sernet.
Yes, this will be support with Samba 4.10 onwards, eg:
log level = 1 full_audit:1@/var/log/audit.log