[role="xpack"]
[[enable-audit-logging]]
== Enable audit logging

You can log security-related events such as authentication failures and refused connections
to monitor your cluster for suspicious activity (including data access authorization and user
security configuration changes).

Audit logging also provides forensic evidence in the event of an attack.

[IMPORTANT]
============================================================================
Audit logs are **disabled** by default. You must explicitly enable audit logging.
============================================================================
--
TIP: Audit logs are only available on certain subscription levels.
For more information, see {subscriptions}.
--

To enable audit logging:

. Set `xpack.security.audit.enabled` to `true` in `elasticsearch.yml`.
. Restart {es}.

When audit logging is enabled, <<audit-event-types, security events>> are persisted to
a dedicated `<clustername>_audit.json` file on the host's file system, on every cluster node.
For more information, see <<audit-log-output>>.

You can configure additional options to control what events are logged and
what information is included in the audit log.
For more information, see <<auditing-settings>>.