# Disabling audit log

**URL:** <https://forum.opensearch.org/t/disabling-audit-log/18235>\
**Category:** OpenSearch\
**Created:** [March 4, 2024, 3:11pm UTC](https://forum.opensearch.org/t/disabling-audit-log/18235 "2024-03-04T15:11:57Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![jgrammen-agilitypr](https://avatars.discourse-cdn.com/v4/letter/j/da6949/32.png) [@jgrammen-agilitypr](https://forum.opensearch.org/u/jgrammen-agilitypr)\
**Post date:** [March 4, 2024, 3:11pm UTC](https://forum.opensearch.org/t/disabling-audit-log/18235/1 "2024-03-04T15:11:57Z")

</div>

**Versions** (relevant - OpenSearch/Dashboard/Server OS/Browser):  
opensearch : 2.12.0  
opensearch-dashboards : 2.12.0  
Ubuntu 22.04.4 LTS

**Describe the issue** :  
Cannot figure out how to disable and remove the audit logs.

does anyone know how to disable the audit log in opensearch? I have found plenty of documentation on enabling it, but nothing on how to disable it. is removing `plugins.security.audit.type: internal_opensearch` sufficient? what about unticking the `enable audit logging` check box in opensearch dashboards? and does that still work even if the `plugins.security.audit.type: internal_opensearch` setting is still present in the opensearch.yaml?  
after disabling how do you remove all the indexes? manually remove them via opensearch dashboards? do you need to close them first?

**Configuration** :

**Relevant Logs or Screenshots** :

---

<div class="post-metadata">

**Author:** ![pablo](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/pablo/32/10363_2.png) [@pablo](https://forum.opensearch.org/u/pablo)\
**Post date:** [March 4, 2024, 6:02pm UTC](https://forum.opensearch.org/t/disabling-audit-log/18235/2 "2024-03-04T18:02:24Z")

</div>

@jgrammen-agilitypr The audit logging is disabled by default and the documentation describes how to enable it.

Removing `plugins.security.audit.type: internal_opensearch` from opensearch.yml or switching off `Enable audit logging` check box in Opensearch Dashboards will disable audit logs.

I’ve just created a pull request in OpenSearch documentation.

> <https://github.com/opensearch-project/documentation-website/pull/6570>
>
> \### Description
> 
> I was working on https://forum.opensearch.org/t/disabling-aud…it-log/18235. The OpenSearch Documentation doesn't mention how to disable Audit logging. 
> The Audit logging is by default disabled and should be enabled manually as per documentation. 
> 
> 
> 
> \### Checklist
> \- \[\] By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license and subject to the \[Developers Certificate of Origin\](https://github.com/opensearch-project/OpenSearch/blob/main/CONTRIBUTING.md#developer-certificate-of-origin).
> For more information on following Developer Certificate of Origin and signing off your commits, please check \[here\](https://github.com/opensearch-project/OpenSearch/blob/main/CONTRIBUTING.md#developer-certificate-of-origin).