smb.conf's directive: log level = 1 auth_json_audit:3@/var/log/samba/audit.json auth_audit:5@/var/log/samba/audit.log according to testparm is just: log level = 1
This is just due to how we have to override the log level internally to make testparm work. samba-tool testparm is written differently and might not show this artefact.
Thank you, I didn't note the newer tool. For me it's fine, Francesco