log level = 1 auth_json_audit:3@/var/log/samba/audit.json auth_audit:5@/var/log/samba/audit.log
according to testparm is just:
log level = 1
This is just due to how we have to override the log level internally to make testparm work.
samba-tool testparm is written differently and might not show this artefact.
Thank you, I didn't note the newer tool. For me it's fine,