> ## Documentation Index
> Fetch the complete documentation index at: https://docs.sazabi.com/llms.txt
> Use this file to discover all available pages before exploring further.

# HashiCorp Vault

> Ship HashiCorp Vault audit device logs to Sazabi through Vector, with each request's path, operation, auth accessor and client IP indexed for search.

[All HashiCorp Vault integration capabilities](https://docs.sazabi.com/catalogs/integrations/vault)

## About

Vault's audit devices record every authenticated API call: secret reads and writes, logins, token creation and revocation, and policy changes. This source ships the file audit device's output to Sazabi through [Vector](https://vector.dev). Vault writes one JSON entry per request and one per response, and Sazabi keeps each entry whole and indexes these fields as attributes:

| Attribute | Vault field |
| - | - |
| `vault.audit.type` | `type` (`request` or `response`) |
| `vault.request.path` | `request.path` |
| `vault.request.operation` | `request.operation` |
| `vault.request.remote_address` | `request.remote_address` (client IP) |
| `vault.auth.accessor` | `auth.accessor` |
| `vault.auth.display_name` | `auth.display_name` |
| `vault.auth.entity_id` | `auth.entity_id` |
| `vault.request.mount_point`, `vault.request.mount_type` | `request.mount_point`, `request.mount_type` |
| `vault.request.namespace.path` | `request.namespace.path` |
| `vault.error` | `error` |

The entry's `time` field becomes the log timestamp.

> [!WARNING]
>
> Vault stops serving requests when it cannot write to any enabled audit device. Keep at least one other audit device enabled alongside this one.

## Prerequisites

* A Vault token with `sudo` capability on `sys/audit/*`.
* [Vector](https://vector.dev/docs/setup/installation/) on each Vault node, able to read the audit log file.
* Your Sazabi intake URL, shown on the log source's setup screen (the public key is embedded in the URL).

## Set up in the dashboard

**Step 1**

### Enable the file audit device

Vault replicates audit devices to every node in the cluster, so run this once:

```bash theme={"system"}
vault audit enable -path=sazabi file file_path=/var/log/vault_audit.log
```

Vault hashes token accessors by default. Add `hmac_accessor=false` to store accessors you can pass to `vault token revoke -accessor`. Vault creates the file with mode `0600`; add `mode=0640` if Vector runs as a different user in the file's group.

**Step 2**

### Add the pipeline to Vector

On every Vault node, add this source, transform and sink. Replace the host in `uri` with your intake URL's host:

```yaml title="vector.yaml" theme={"system"}
sources:
  vault_audit:
    type: file
    include: ["/var/log/vault_audit.log"]
    # Vault writes one JSON object per line; large responses exceed Vector's 100 KiB default.
    max_line_bytes: 1048576

transforms:
  vault_audit_json:
    type: remap
    inputs: ["vault_audit"]
    source: |
      . = parse_json!(string!(.message))

sinks:
  sazabi_vault_audit:
    type: http
    inputs: ["vault_audit_json"]
    uri: "https://<your intake host>/"
    method: post
    encoding:
      codec: json
    framing:
      method: newline_delimited
```

The intake URL carries the public key in its hostname, so the sink needs no auth header.

**Step 3**

### Reload Vector

Reload Vector (`systemctl reload vector`, or restart its container). If this configuration is version-controlled, commit it on a new branch, push it, and open a pull request. Otherwise apply it directly.

### Use the socket audit device instead

To skip the file, enable Vault's socket audit device and point it at a Vector `socket` source on the same host. Vault blocks requests when the socket is unreachable, so keep a file device enabled as well.

```bash theme={"system"}
vault audit enable -path=sazabi-socket socket address=127.0.0.1:9090 socket_type=tcp
```

```yaml title="vector.yaml" theme={"system"}
sources:
  vault_audit:
    type: socket
    mode: tcp
    address: 127.0.0.1:9090
    max_length: 1048576
```

Keep the `vault_audit_json` transform and `sazabi_vault_audit` sink from the steps above.

## Set up with the CLI

You can also register the Vault log source with the [Sazabi CLI](https://docs.sazabi.com/reference/cli/log-sources.md):

```bash theme={"system"}
sazabi log-sources create vault --mode manual
```

The command prints the intake URL for the new source. Use its host in the Vector sink above. Run `sazabi log-sources get <log-source-id>` to reprint it.

## Verify

Run any authenticated Vault command, such as `vault token lookup`. Open the [Intake page](https://docs.sazabi.com/guides/instrument/intake.md) and confirm a request entry and a response entry from the **HashiCorp Vault** source appear within a minute. Search for `vault.request.path` to find calls to a specific path.

## Troubleshooting

**No entries arrive** — Check that Vector can read `/var/log/vault_audit.log` (`sudo -u vector head -1 /var/log/vault_audit.log`) and that its logs show no errors on the `sazabi_vault_audit` sink.

**Entries stop after log rotation** — Vault keeps writing to the old file until it receives a `SIGHUP`. Send one from your logrotate `postrotate` script.

**Accessors are hashed** — Vault HMACs accessors unless the device was enabled with `hmac_accessor=false`. Use `vault audit hash` to compute the hashed form of a known accessor and search for it.

## Further reading

> [card] [Vault audit devices](https://developer.hashicorp.com/vault/docs/audit)
>
> HashiCorp's reference for the file, socket, and syslog audit devices.

> [card] [Intake](https://docs.sazabi.com/guides/instrument/intake.md)
>
> See per-source ingestion volume and health.

> [card] [Log sources](https://docs.sazabi.com/catalogs/log-sources.md)
>
> Browse the full log source catalog.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.