# Audit logs not updating properly

**URL:** <https://discuss.elastic.co/t/audit-logs-not-updating-properly/204013>\
**Category:** Elasticsearch\
**Created:** [October 17, 2019, 9:33am UTC](https://discuss.elastic.co/t/audit-logs-not-updating-properly/204013 "2019-10-17T09:33:19Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![arun.kumar92](https://avatars.discourse-cdn.com/v4/letter/a/e5b9ba/32.png) [@arun.kumar92](https://discuss.elastic.co/u/arun.kumar92)\
**Post date:** [October 17, 2019, 9:33am UTC](https://discuss.elastic.co/t/audit-logs-not-updating-properly/204013/1 "2019-10-17T09:33:19Z")

</div>

Hi Folks

I'm facing an issue in elasticsearch audit logs part. Audit logs not updating after somtime during restart.

## Configuration details

Kindly go through the below log4j2.properties file  
`status = error

appender.console.type = Console  
appender.console.name = console  
appender.console.layout.type = PatternLayout  
appender.console.layout.pattern = [%d{ISO8601}][%-5p][%-25c{1.}] [%node\_name]%marker %m%n

rootLogger.level = info  
rootLogger.appenderRef.console.ref = console

appender.audit\_rolling.type = RollingFile  
appender.audit\_rolling.name = audit\_rolling  
appender.audit\_rolling.fileName = {sys:es.logs.base\_path}{sys:file.separator}{sys:es.logs.cluster\_name}\_audit.log appender.audit\_rolling.layout.type = PatternLayout appender.audit\_rolling.layout.pattern = [%d{ISO8601}] %m%n appender.audit\_rolling.filePattern = {sys:es.logs.base\_path}{sys:file.separator}{sys:es.logs.cluster\_name}\_audit-%d{yyyy-MM-dd}.log  
appender.audit\_rolling.policies.type = Policies  
appender.audit\_rolling.policies.time.type = TimeBasedTriggeringPolicy  
appender.audit\_rolling.policies.time.interval = 1  
appender.audit\_rolling.policies.time.modulate = true

logger.xpack\_security\_audit\_logfile.name = org.elasticsearch.xpack.security.audit.logfile.LoggingAuditTrail  
logger.xpack\_security\_audit\_logfile.level = info  
logger.xpack\_security\_audit\_logfile.appenderRef.audit\_rolling.ref = audit\_rolling`

elasticsearch.yml  
xpack.security.enabled: true  
xpack.security.audit.enabled: true

Elasticsearch version : 6.8.2

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 14, 2019, 9:33am UTC](https://discuss.elastic.co/t/audit-logs-not-updating-properly/204013/2 "2019-11-14T09:33:22Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.