---
layout: docs
page_title: "audit enable - Vault CLI"
description: >-
  Create and enable a new audit device to capture log data from Vault.
---

> [!IMPORTANT]  
> **Documentation Update:** Product documentation, which were located in this repository under `/website`, are now located in [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs), colocated with all other product documentation. Contributions to this content should be done in the `web-unified-docs` repo, and not this one. Changes made to `/website` content in this repo will not be reflected on the developer.hashicorp.com website.

# `audit enable`

Enable a new audit device.

<CodeBlockConfig hideClipboard>

```shell-session
$ vault audit enable [flags] <device_type> [options] [<config_argument=value>...]

$ vault audit enable [-help | -h]
```

</CodeBlockConfig>

## Description

`audit enable` creates and enables an audit device at the given path or returns
an error if an audit device already exists at the given path. The device
configuration parameters depend on the audit device type.

<Tip title="Related API endpoints">

  EnableAuditDevice - [`POST:/sys/audit/{mount-path}`](/vault/api-docs/system/audit#enable-audit-device)

</Tip>



## Command arguments

@include 'cli/audit/args/device_type.mdx'

Each audit device type also has a set of configuration arguments:

<Tabs>

<Tab heading="File">

<CodeBlockConfig hideClipboard>

```shell-session
$ vault audit enable [flags] file [options] \
    file_path=<path/to/log/file>            \
    [mode=<file_permissions>]
```

</CodeBlockConfig>

<br />

@include 'cli/audit/args/file/file_path.mdx'

<br /><hr /><br />

@include 'cli/audit/args/file/mode.mdx'

</Tab>

<Tab heading="Socket">

<CodeBlockConfig hideClipboard>

```shell-session
$ vault audit enable [flags] socket [options] \
    [address=<server_address>]                \
    [socket_type=<protocol>]                  \
    [write_timeout=<wait_time>]
```

</CodeBlockConfig>

<br />

@include 'cli/audit/args/socket/address.mdx'

<br /><hr /><br />

@include 'cli/audit/args/socket/socket_type.mdx'

<br /><hr /><br />

@include 'cli/audit/args/socket/write_timeout.mdx'

</Tab>

<Tab heading="Syslog">

<CodeBlockConfig hideClipboard>

```shell-session
$ vault audit enable [flags] syslog [options] \
    [facility=<process_entry_source>]         \
    [tag=<program_entry_source>]
```

</CodeBlockConfig>

<br />

@include 'cli/audit/args/syslog/facility.mdx'

<br /><hr /><br />

@include 'cli/audit/args/syslog/tag.mdx'

</Tab>

</Tabs>

## Command options

<br />

@include 'cli/audit/options/elide_list_responses.mdx'

<br /><hr /><br />

@include 'cli/audit/options/exclude.mdx'

<br /><hr /><br />

@include 'cli/audit/options/fallback.mdx'

<br /><hr /><br />

@include 'cli/audit/options/filter.mdx'

<br /><hr /><br />

@include 'cli/audit/options/format.mdx'

<br /><hr /><br />

@include 'cli/audit/options/hmac_accessor.mdx'

<br /><hr /><br />

@include 'cli/audit/options/log_raw.mdx'

<br /><hr /><br />

@include 'cli/audit/options/prefix.mdx'

## Command flags

<br />

@include 'cli/audit/flags/description.mdx'

<br /><hr /><br />

@include 'cli/audit/flags/local.mdx'

<br /><hr /><br />

@include 'cli/audit/flags/path.mdx'

## Standard flags

<br />

@include 'cli/standard-settings/all-standard-flags-but-format.mdx'

## Examples

Enable a `file` type audit device at the default path, `file/`:

```shell-session
$ vault audit enable file file_path=/tmp/my-file.txt
Success! Enabled the file audit device at: file/
```

Enable a `file` type audit device at the path, `audit/file`:

```shell-session
$ vault audit enable -path=audit/file file file_path=/tmp/my-file.txt
Success! Enabled the file audit device at: audit/file/
```