# Source: https://docs.datadoghq.com/security/default_rules/def-000-k41.md

---
title: System Audit Logs Must Be Owned By Root
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: Docs > Datadog Security > OOTB Rules > System Audit Logs Must Be Owned By Root
---

# System Audit Logs Must Be Owned By Root
 
## Description{% #description %}

All audit logs must be owned by root user. The path for audit log can be configured via `log_file` parameter in

```
/etc/audit/auditd.conf
```

or by default, the path for audit log is

```gdscript3
/var/log/audit/
```

. To properly set the owner of `/var/log/audit/*`, run the command:

```gdscript3
$ sudo chown root /var/log/audit/* 
```

## Rationale{% #rationale %}

Unauthorized disclosure of audit records can reveal system and configuration data to attackers, thus compromising its confidentiality.

## Remediation{% #remediation %}

### Shell script{% #shell-script %}

The following script can be run on the host to remediate the issue.

```bash
#!/bin/bash

# Remediation is applicable only in certain platforms
if dpkg-query --show --showformat='${db:Status-Status}' 'auditd' 2>/dev/null | grep -q '^installed$' && dpkg-query --show --showformat='${db:Status-Status}' 'linux-base' 2>/dev/null | grep -q '^installed$'; then

if LC_ALL=C grep -iw log_file /etc/audit/auditd.conf; then
    FILE=$(awk -F "=" '/^log_file/ {print $2}' /etc/audit/auditd.conf | tr -d ' ')
    chown root $FILE*
else
    chown root /var/log/audit/audit.log*
fi

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi
```