Skip to main content
All HashiCorp Vault integration capabilities

​
About

Vault’s audit devices record every authenticated API call: secret reads and writes, logins, token creation and revocation, and policy changes. This source ships the file audit device’s output to Sazabi through Vector. Vault writes one JSON entry per request and one per response, and Sazabi keeps each entry whole and indexes these fields as attributes: The entry’s time field becomes the log timestamp.
Vault stops serving requests when it cannot write to any enabled audit device. Keep at least one other audit device enabled alongside this one.

​
Prerequisites

  • A Vault token with sudo capability on sys/audit/*.
  • Vector on each Vault node, able to read the audit log file.
  • Your Sazabi intake URL, shown on the log source’s setup screen (the public key is embedded in the URL).

​
Set up in the dashboard

1

​
Enable the file audit device

Vault replicates audit devices to every node in the cluster, so run this once:
Vault hashes token accessors by default. Add hmac_accessor=false to store accessors you can pass to vault token revoke -accessor. Vault creates the file with mode 0600; add mode=0640 if Vector runs as a different user in the file’s group.
2

​
Add the pipeline to Vector

On every Vault node, add this source, transform and sink. Replace the host in uri with your intake URL’s host:
vector.yaml
The intake URL carries the public key in its hostname, so the sink needs no auth header.
3

​
Reload Vector

Reload Vector (systemctl reload vector, or restart its container). If this configuration is version-controlled, commit it on a new branch, push it, and open a pull request. Otherwise apply it directly.

​
Use the socket audit device instead

To skip the file, enable Vault’s socket audit device and point it at a Vector socket source on the same host. Vault blocks requests when the socket is unreachable, so keep a file device enabled as well.
vector.yaml
Keep the vault_audit_json transform and sazabi_vault_audit sink from the steps above.

​
Set up with the CLI

You can also register the Vault log source with the Sazabi CLI:
The command prints the intake URL for the new source. Use its host in the Vector sink above. Run sazabi log-sources get <log-source-id> to reprint it.

​
Verify

Run any authenticated Vault command, such as vault token lookup. Open the Intake page and confirm a request entry and a response entry from the HashiCorp Vault source appear within a minute. Search for vault.request.path to find calls to a specific path.

​
Troubleshooting

No entries arrive — Check that Vector can read /var/log/vault_audit.log (sudo -u vector head -1 /var/log/vault_audit.log) and that its logs show no errors on the sazabi_vault_audit sink. Entries stop after log rotation — Vault keeps writing to the old file until it receives a SIGHUP. Send one from your logrotate postrotate script. Accessors are hashed — Vault HMACs accessors unless the device was enabled with hmac_accessor=false. Use vault audit hash to compute the hashed form of a known accessor and search for it.

​
Further reading

Vault audit devices

HashiCorp’s reference for the file, socket, and syslog audit devices.

Intake

See per-source ingestion volume and health.

Log sources

Browse the full log source catalog.