vault/website/content/docs/audit/file.mdx

---
layout: docs
page_title: File - Audit Devices
description: The "file" audit device writes audit logs to a file.
---

# File audit device

The `file` audit device writes audit logs to a file. This is a very simple audit
device: it appends logs to a file.

The device does not currently assist with any log rotation. There are very
stable and feature-filled log rotation tools already, so we recommend using
existing tools.

Sending a `SIGHUP` to the Vault process will cause `file` audit devices to close
and re-open their underlying file, which can assist with log rotation needs.

## Examples

Enable at the default path:

```shell-session
$ vault audit enable file file_path=/var/log/vault_audit.log
```

Enable at a different path. It is possible to enable multiple copies of an audit
device:

```shell-session
$ vault audit enable -path="vault_audit_1" file file_path=/home/user/vault_audit.log
```

Enable logs on stdout. This is useful when running in a container:

```shell-session
$ vault audit enable file file_path=stdout
```

## Configuration

Note the difference between `audit enable` command options and the `file` backend
configuration options. Use `vault audit enable -help` to see the command options.

The `file` audit device supports the common configuration options documented on
the [main Audit Devices page](/vault/docs/audit#common-configuration-options), and
these device-specific options:

- `file_path` `(string: <required>)` - The path to where the audit log will be
  written. If a file already exists at the given path, the audit backend will
  append to it. There are some special keywords:

  - `stdout` writes the audit log to standard output

  - `discard` discards output, instead of writing it to a device (useful in testing scenarios)

- `mode` `(string: "0600")` - A string containing an octal number representing
  the bit pattern for the file mode, similar to `chmod`. Set to `"0000"` to
  prevent Vault from modifying the file mode.

## Log file rotation

To properly rotate Vault File Audit Device log files on BSD, Darwin, or Linux-based Vault servers, it is important that you configure your log rotation software to send the `vault` process a signal hang up / `SIGHUP` after each rotation of the log file.