# Audit log not getting **URL:** \ **Category:** OpenSearch\ **Created:** [October 20, 2023, 6:29am UTC](https://forum.opensearch.org/t/audit-log-not-getting/16357 "2023-10-20T06:29:16Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![Ashish](https://avatars.discourse-cdn.com/v4/letter/a/ea666f/32.png) [@Ashish](https://forum.opensearch.org/u/Ashish)\ **Post date:** [October 20, 2023, 6:29am UTC](https://forum.opensearch.org/t/audit-log-not-getting/16357/1 "2023-10-20T06:29:16Z")
**Versions** (relevant - OpenSearch/Dashboard/Server OS/Browser): 2.11.0 **Describe the issue** : I am using Opensearch 2.11.0 version on RPM machine(Red HAT) . After enabling the audit log and configuring the required audit log setting,I have executed few queries but I am not getting audit logs. Please let me know if anything I am missing. **Configuration** : ## I did below configuration for audit log in opensearch.yml file plugins.security.audit.type: internal\_opensearch ## Configuration for audit log in audit.yml file plugins.security.audit.config.ignore\_users: kibanaserver plugins.security.audit.config.enable\_rest: true plugins.security.audit.config.enable\_transport: true plugins.security.audit.config.disabled\_rest\_categories: NONE plugins.security.audit.config.disabled\_transport\_categories: NONE plugins.security.audit.config.log\_request\_body: true **Relevant Logs or Screenshots** : ---
**Author:** ![Ashish](https://avatars.discourse-cdn.com/v4/letter/a/ea666f/32.png) [@Ashish](https://forum.opensearch.org/u/Ashish)\ **Post date:** [October 25, 2023, 1:46pm UTC](https://forum.opensearch.org/t/audit-log-not-getting/16357/2 "2023-10-25T13:46:15Z")
Hi team, Can you please guide me for above query ? ---
**Author:** ![Mantas](https://avatars.discourse-cdn.com/v4/letter/m/7bcc69/32.png) [@Mantas](https://forum.opensearch.org/u/Mantas)\ **Post date:** [November 6, 2023, 3:30pm UTC](https://forum.opensearch.org/t/audit-log-not-getting/16357/3 "2023-11-06T15:30:43Z")
Hi @Ashish, Could you please run `GET _cat/indices/*auditlog*` in your Dev Tools (or any convenient way for you) and share the output? Best, Mantas ---
**Author:** ![Ashish](https://avatars.discourse-cdn.com/v4/letter/a/ea666f/32.png) [@Ashish](https://forum.opensearch.org/u/Ashish)\ **Post date:** [November 7, 2023, 7:31am UTC](https://forum.opensearch.org/t/audit-log-not-getting/16357/4 "2023-11-07T07:31:31Z")
Below Response I am getting while executing GET \_cat/indices/_auditlog_ yellow open auditlog-2023.10.20 fQhc4-jPQDytQtnS-1GHIw 1 1 1 0 12.7kb 12.7kb yellow open auditlog-2023.11.02 5WZifgOfS1KBWeybUgat4g 1 1 13 0 97.4kb 97.4kb yellow open auditlog-2023.11.03 dh3\_2RF4S2er\_RBolGUJsw 1 1 4004 0 1.8mb 1.8mb yellow open auditlog-2023.11.06 o2E\_hK1HT8udnmcFZnaFaA 1 1 16350 0 4.5mb 4.5mb yellow open auditlog-2023.10.27 zrjdJ9G1QqSD5a9ZqnxM\_w 1 1 4 0 50.8kb 50.8kb yellow open security-auditlog-2023.10.26 5l7ps\_ujSCWkCZE2Iz49hw 1 1 2 0 32kb 32kb yellow open auditlog-2023.10.26 FmIe2hVpSsWg-nBeylrIcg 1 1 16 0 120.6kb 120.6kb yellow open security-auditlog-2023.10.19 XuSi47fiRDCVD2TO6jXxAQ 1 1 4 0 61kb 61kb But my questions here where I can see this audit log file in OpenSearch application on backend means in which directory . I am looking at /var/log/opensearch directory at this location I am unable to get any files related to audit log ---
**Author:** ![Mantas](https://avatars.discourse-cdn.com/v4/letter/m/7bcc69/32.png) [@Mantas](https://forum.opensearch.org/u/Mantas)\ **Post date:** [November 7, 2023, 10:38am UTC](https://forum.opensearch.org/t/audit-log-not-getting/16357/5 "2023-11-07T10:38:58Z")
> [@Ashish](#): > > plugins.security.audit.type: internal\_opensearch If the `internal_opensearch` is used the audit logs are stored locally (same cluster) in the index `" index named (security-)auditlog-YYYY.MM.dd`:"` more details here: [Audit logs - OpenSearch documentation](https://opensearch.org/docs/latest/security/audit-logs/index/#configure-the-audit-log-index-name) If you would like to store your audit logs in files or other different means, please check here: [Audit log storage types - OpenSearch documentation](https://opensearch.org/docs/latest/security/audit-logs/storage-types/) let me know if you have any further questions. Best, Mantas ---
**Author:** ![Ashish](https://avatars.discourse-cdn.com/v4/letter/a/ea666f/32.png) [@Ashish](https://forum.opensearch.org/u/Ashish)\ **Post date:** [November 7, 2023, 11:13am UTC](https://forum.opensearch.org/t/audit-log-not-getting/16357/6 "2023-11-07T11:13:32Z")
I have used internal-opensearch for that I am not getting and created index “'security-auditlog-'YYYY.MM.dd” using below configuration in opensearch.yml plugins.security.audit.config.index: “'security-auditlog-'YYYY.MM.dd” But unable to find any log file as security-auditlog-\* ---
**Author:** ![Mantas](https://avatars.discourse-cdn.com/v4/letter/m/7bcc69/32.png) [@Mantas](https://forum.opensearch.org/u/Mantas)\ **Post date:** [November 7, 2023, 11:17am UTC](https://forum.opensearch.org/t/audit-log-not-getting/16357/7 "2023-11-07T11:17:09Z")
It is stored in indexes, not in files. You can use log4j to get logs to files: [Audit log storage types - OpenSearch documentation](https://opensearch.org/docs/latest/security/audit-logs/storage-types/#log4j) ---
**Author:** ![Ashish](https://avatars.discourse-cdn.com/v4/letter/a/ea666f/32.png) [@Ashish](https://forum.opensearch.org/u/Ashish)\ **Post date:** [November 7, 2023, 12:03pm UTC](https://forum.opensearch.org/t/audit-log-not-getting/16357/8 "2023-11-07T12:03:28Z")
Using log4j also, I am unable to find any audit log file. checking logs at /var/log/opensearch directory ![Screenshot for opensearch log directory](https://us1.discourse-cdn.com/flex019/uploads/mauve_hedgehog/original/2X/4/4871e9b451b20e43752d9178b96f20d60678d262.png) ---
**Author:** ![Mantas](https://avatars.discourse-cdn.com/v4/letter/m/7bcc69/32.png) [@Mantas](https://forum.opensearch.org/u/Mantas)\ **Post date:** [November 17, 2023, 12:34pm UTC](https://forum.opensearch.org/t/audit-log-not-getting/16357/9 "2023-11-17T12:34:10Z")
Hi @Ashish, Could you please share your configuration in `opensearch.yml` and `log4j`? Thanks, Mantas