How to change the path of the auditd log file /var/log/audit/audit.log?

Updated: 28 September 2026 · Applies to: AlmaLinux 9 / Rocky Linux 9

auditd records security events in /var/log/audit/audit.log. You can move the log, for example to a larger disk. These steps are for AlmaLinux 9 / Rocky Linux 9; on Ubuntu/Debian install it with apt install auditd.

1. Create the new directory, readable only by root: mkdir -p /data/audit && chmod 700 /data/audit
2. On AlmaLinux/Rocky, give it the SELinux label of the audit log: semanage fcontext -a -t auditd_log_t "/data/audit(/.*)?" && restorecon -Rv /data/audit
3. In /etc/audit/auditd.conf, set log_file = /data/audit/audit.log.
4. Restart auditd with service auditd restart. (systemctl restart auditd is refused on purpose; use the service command.)
5. Check that new events arrive: tail /data/audit/audit.log.

Other useful settings in auditd.conf

• max_log_file: size of one log file in MB.
• num_logs: how many rotated files to keep.
• max_log_file_action = ROTATE: rotate instead of stopping when the file is full.

Check the audit logs

du -sh /data/audit            # space used
aureport --summary             # overview of recorded events
ausearch -m USER_LOGIN -i      # login events, readable