Not sure audit works, as vault user doesn't have access on /var/log/vault_audit.log.
Mar 30 21:30:54 complector vault[39389]: 2022-03-30T21:30:54.763Z [ERROR] secrets.system.system_a5244e72: enable audit mount failed: path=file/ error="sanity check failed; unable to open \"/var/log/vault_audit.log\" for writing: open /var/log/vault_audit.log: permission denied" Mar 30 21:31:03 complector vault[39389]: 2022-03-30T21:31:03.429Z [ERROR] secrets.system.system_a5244e72: enable audit mount failed: path=file/ error="sanity check failed; unable to open \"vault_audit.log\" for writing: mkdir .: permission denied" Mar 30 21:32:02 complector vault[39389]: 2022-03-30T21:32:02.171Z [INFO] core: enabled audit backend: path=file/ type=file