I enabled SMB/CIFS audit and when i open/read/delete files i can see in the events in Event Viewer -> Security connecting remotely to NAS server but from today it stop working and new events are not registered there. Any log or workaround to know why and how to fix this?