Apparently Isilon OneFS 7.1 changes the way it does auditing. I used to be able go look at smb.log and see activity, not anymore.