# Xpack.Security.Audit.Index-Information

**URL:** <https://discuss.elastic.co/t/xpack-security-audit-index-information/185472>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-security\
**Created:** [June 12, 2019, 4:58pm UTC](https://discuss.elastic.co/t/xpack-security-audit-index-information/185472 "2019-06-12T16:58:42Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![bkasrai](https://avatars.discourse-cdn.com/v4/letter/b/b5a626/32.png) [@bkasrai](https://discuss.elastic.co/u/bkasrai)\
**Post date:** [June 12, 2019, 4:58pm UTC](https://discuss.elastic.co/t/xpack-security-audit-index-information/185472/1 "2019-06-12T16:58:42Z")

</div>

Good afternoon,  
I am looking to have the xpack.security.audit.enabled on my ES cluster however I was looking to understand where this should be enabled at\on. I have multiple nodes within my cluster, each with different roles (data\master\coordinating) Logic would dictate that this should be enabled on my coordinating nodes however after doing a bit more reading, I am seeing some I\O concerns when querying etc. I am assuming that even though this is enabled on the coordinating node(s), the index (when created) will be handled by the data nodes respectively so I\O shouldn't be a concern. Can someone please confirm this when time permits?

---

<div class="post-metadata">

**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\
**Post date:** [June 13, 2019, 1:21am UTC](https://discuss.elastic.co/t/xpack-security-audit-index-information/185472/2 "2019-06-13T01:21:33Z")

</div>

You should enable auditing on every node.

Events are audited on the nodes on which they happen. For most events that will be the coordinating node, but you will miss things if you don't audit on the data (and even master) nodes.

---

<div class="post-metadata">

**Author:** ![bkasrai](https://avatars.discourse-cdn.com/v4/letter/b/b5a626/32.png) [@bkasrai](https://discuss.elastic.co/u/bkasrai)\
**Post date:** [June 13, 2019, 12:00pm UTC](https://discuss.elastic.co/t/xpack-security-audit-index-information/185472/3 "2019-06-13T12:00:17Z")

</div>

Awesome. Thanks Tim. I’ll work to get that done. Appreciate you getting back to me.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 11, 2019, 12:04pm UTC](https://discuss.elastic.co/t/xpack-security-audit-index-information/185472/4 "2019-07-11T12:04:06Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.