When starting eventlogadm with -d, one can see, that eventlogadm uses the wrong configuration file "smb.conf" instead of "my.smb.conf" which is used by the running smbd and winbind. (smb.conf is used by a different smbd!!!)

This causes the write of event logs to some "obscure" other file.

So eventlogadm definitely needs a -s parameter which shows the path to the correct configuration.

eventlogadm ....

Starting write for eventlog [Application]
Active eventlog names (from smb.conf):
--------------------------------------
        <None specified>
Read line [LEN:0]
Read line [RS1:1699505740]
Read line [RCN:0]
Read line [TMG:1259606958]
Read line [TMW:1259606958]
Read line [EID:1000]
Read line [ETP:MeinTest]
Read line [ECT:0]
Read line [RS2:0]
Read line [CRN:0]
Read line [USL:0]
Read line [SRC:ads]
Read line [SRN:nasdrive5]
Read line [STR:MeinTest]
Read line [DAT:]
Read line []
record number [0], tg [1259606958] , tw [1259606958]
Wrote record 11

---------------------------------
Check resulting tdb with tdbdump:
---------------------------------

tdbdump sysloglinux.tdb
{
key(13) = "INFO/maxsize\00"
data(4) = "\00\08\00\00"
}
{
key(18) = "INFO/oldest_entry\00"
data(4) = "\01\00\00\00"
}
{
key(17) = "INFO/next_record\00"
data(4) = "\01\00\00\00"
}
{
key(13) = "INFO/version\00"
data(4) = "\01\00\00\00"
}
{
key(15) = "INFO/retention\00"
data(4) = "\00\09:\80"
}