HashiCorp Vault — Audit Devices

Audit devices record every request and response to Vault, including who made the request, what was accessed, and when. They are critical for compliance and security.

---

Audit Device Types

Type	Description	Use Case
File	Write to a local file	Simple deployments, log shipping
Syslog	Send to syslog daemon	Centralized logging
Socket	Stream to TCP/UDP socket	Real-time SIEM integration

---

Important Rules

Vault will block ALL requests if all audit devices fail. Always enable at least two audit devices for redundancy.

Sensitive values are HMAC’d by default — actual secret values are hashed, not logged in plaintext.

---

File Audit Device

# Enable file audit
vault audit enable file file_path=/var/log/vault/audit.log

# With options
vault audit enable -path=file-audit file \
    file_path=/var/log/vault/audit.log \
    log_raw=false \
    hmac_accessor=true \
    mode=0640

Log Rotation

Vault doesn’t rotate logs itself. Use logrotate:

# /etc/logrotate.d/vault
/var/log/vault/audit.log {
    daily
    rotate 30
    compress
    delaycompress
    missingok
    notifempty
    copytruncate
}

---

Syslog Audit Device

vault audit enable syslog \
    tag="vault" \
    facility="AUTH"

---

Socket Audit Device

# TCP socket (e.g., Logstash, Fluentd)
vault audit enable socket \
    address="logstash.internal:5044" \
    socket_type="tcp"

# UDP socket
vault audit enable -path=socket-udp socket \
    address="logserver.internal:5514" \
    socket_type="udp"

---

Multiple Audit Devices

# Best practice: enable at least 2 for redundancy
vault audit enable -path=file file file_path=/var/log/vault/audit.log
vault audit enable -path=syslog syslog tag="vault" facility="AUTH"

# List enabled audit devices
vault audit list -detailed

---

Raw Audit Logs

By default, sensitive values are HMAC’d. To see raw values (dangerous):

vault audit enable -path=raw-file file \
    file_path=/var/log/vault/audit-raw.log \
    log_raw=true

Warning: Raw audit logs contain actual secret values. Use only for debugging and protect the log files accordingly.

---

Disable Audit Device

# Disable a specific audit device
vault audit disable file

# List remaining devices
vault audit list

---

Quick Reference

Command	Description
vault audit enable file file_path=PATH	Enable file audit
vault audit enable syslog	Enable syslog audit
vault audit enable socket address=ADDR	Enable socket audit
vault audit list -detailed	List audit devices
vault audit disable PATH	Disable audit device

---

Next: Audit Log Format