Audit log volume management — the rotation and archival

The audit log volume management is the discipline of managing the audit log files. The rotation, the archival, the long-term storage are the components. The disk usage is the constraint. This lesson walks the volume management, the rotation, the archival, and the production patterns.

The audit log rotation

The audit log rotation:

apiVersion: v1
kind: Pod
metadata:
  name: kube-apiserver
spec:
  containers:
  - name: kube-apiserver
    command:
    - kube-apiserver
    - --audit-log-path=/var/log/kubernetes/audit.log
    - --audit-log-maxage=30
    - --audit-log-maxbackup=10
    - --audit-log-maxsize=100

The rotation is the kube-apiserver’s responsibility.

The rotation parameters

The rotation parameters:

maxsize: 100M (max size per file)
maxbackup: 10 (number of backups)
maxage: 30 (number of days)

The parameters are the rotation configuration.

The logrotate

The logrotate:

# /etc/logrotate.d/kubernetes-audit
/var/log/kubernetes/audit.log {
  daily
  rotate 30
  size 100M
  compress
  missingok
  notifempty
  postrotate
    # Send the audit log to the central log server
    systemctl reload audit-log-shipping
  endscript
}

The logrotate is the system-level rotation.

The long-term storage

The long-term storage:

# Ship the audit log to S3
aws s3 cp /var/log/kubernetes/audit.log.s3 s3://k8s-audit-logs/

# Use the SIEM
filebeat -e -c audit-filebeat.yaml

The long-term storage is the disaster recovery.

The central log shipping

The central log shipping:

# Filebeat config
filebeat.inputs:
- type: log
  paths:
    - /var/log/kubernetes/audit.log
  fields:
    log_type: audit
output.loki:
  hosts:
    - http://loki:3100
  labels:
    job: audit-log

The central log shipping is the integration.

The disk usage monitoring

The disk usage monitoring:

# Disk usage
node_filesystem_avail_bytes{mountpoint="/var/log/kubernetes"}

The disk usage is the input for the alerts.

The alert:

- alert: AuditLogDiskUsage
  expr: |
    node_filesystem_avail_bytes{mountpoint="/var/log/kubernetes"} < 1 * 1024 * 1024 * 1024
  for: 5m
  labels:
    severity: warning
  annotations:
    summary: "Audit log disk usage < 1GB"

The alert fires when the disk is full.

The audit log archival

The audit log archival:

# Archive the old audit logs
gzip /var/log/kubernetes/audit.log.2026-08-01

# Move to the long-term storage
aws s3 mv /var/log/kubernetes/audit.log.2026-08-01.gz s3://k8s-audit-logs/

# Delete the local archive
rm /var/log/kubernetes/audit.log.2026-08-01.gz

The archival is the long-term storage.

The retention policy

The retention policy:

# Local: 30 days
# S3: 1 year (hot)
# Glacier: 5 years (cold)

The retention policy is the input for the archival.

The production patterns

The production patterns:

flowchart LR
    A[Audit event] --> B[kube-apiserver]
    B --> C[Log file]
    B --> D[Webhook]
    C --> E[Rotation]
    E --> F[Long-term storage]
    C --> G[Filebeat]
    G --> H[Loki]
    F --> I[S3]
    D --> J[SIEM]

The pattern is the production discipline.

The cross-course references

• The API server course covers the audit configuration.
• The Security course covers the audit policies.
• The SIEM course covers the integration.

Quiz

Production discipline

• Configure the rotation. maxsize, maxbackup, maxage.
• Configure the logrotate. The system-level rotation.
• Configure the long-term storage. S3, Glacier.
• Configure the central log shipping. Filebeat, Promtail.
• Configure the disk usage alerts. The disk full alerts.
• Document the volume management. The rotation, the archival.

The audit log volume management is the operational discipline. Operating it well is the rotation, the archival, the long-term storage, and the production patterns.