В секцию global файла /etc/samba/smb.conf добавить строку:

[global]
log level = 1 auth_json_audit:3@/var/log/samba/samba_audit.log

Создать файл /etc/rsyslog.d/send_samba.conf:

module(load="imfile" PollingInterval="10") #needs to be done just once
input(type="imfile"
     File="/var/log/samba/samba_audit.log"
     Tag="samba_auth"
     Severity="info"
     Facility="auth")
if ($syslogtag == "samba_auth") then {
   action(type="omfwd" target="dc1.test.alt" port="514" protocol="tcp"
          action.resumeRetryCount="100"
          queue.type="linkedList" queue.size="10000")
}