if $programname == "smbd_audit" then {
    if $msg contains "|open|ok|r|" then stop else -/var/log/samba/audit.log
    & stop
}
