> ## Documentation Index
> Fetch the complete documentation index at: https://notes.kodekloud.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Audit Devices
> This article explains Vaults audit devices, their configuration, types, best practices, and the importance of maintaining secure logging for compliance auditing.
Vault’s audit devices produce detailed JSON logs for every authenticated request and response. These logs can be forwarded to a SIEM or any log-aggregation tool for real-time alerting and compliance auditing. Sensitive data is hashed before logging, ensuring that secrets remain protected while still providing verifiable audit trails.
## Enabling a File-Based Audit Device
To start logging to a local file, run:
```bash theme={null}
vault audit enable file file_path=/var/log/vault_audit_log.log
```
Ensure the operating-system user running Vault (commonly `vault`) has write permissions for `/var/log/vault_audit_log.log`. Without proper permissions, Vault will fail to enable the audit device.
## Audit Device Types
Vault currently offers three built-in audit backends:
| Audit Device Type | Description | Ideal Use Case |
| ----------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------ |
| file | Appends JSON-formatted logs to a local file. Requires external agents (e.g., [Fluentd](https://www.fluentd.org/), AWS [CloudWatch Logs agent](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/AgentReference.html)) for shipping and log rotation. | On-premises deployments or standalone Vault servers. |
| syslog | Forwards logs to the local syslog daemon, which can relay to a centralized syslog server. | Environments with existing syslog infrastructure. |
| socket | Streams logs over TCP, UDP, or Unix sockets. Avoid UDP for critical logs due to its inherent unreliability. | Remote log aggregation services or custom logging pipelines. |
## Best Practices
Vault prioritizes security over availability: if it cannot write to any enabled audit device, it will refuse client requests and effectively go offline rather than risk losing audit data.
* Always enable at least one audit device to maintain a complete security trail.
* Deploy multiple audit backends to prevent a single point of failure.
* Regularly test your logging pipeline and verify that logs reach your SIEM or retention system.
* Monitor audit-device health and configure alerts for write failures.
## Further Reading
* [Vault Audit Logging](https://www.vaultproject.io/docs/audit)
* [Kubernetes Logging Best Practices](https://kubernetes.io/docs/concepts/cluster-administration/logging/)
* [Security Information and Event Management (SIEM)](/docs/siem)