notfound 341249 2:3.2.3-2 kthxbye Reading the docs more closely, I can't actually find any reference saying that the audit module logs to anything else than syslog. You seem to have confused the audit and extd_audit modules.