audit

Manage Vault audit devices and Loki/Grafana integration in the HAL lab.

29|8|Updated Mar 24, 2026
One-click install
npx skills add https://github.com/hashimiche/hal --skill audit-hashimiche
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: audit
Source: https://github.com/hashimiche/hal/tree/main/internal/skills/data/vault/audit
Command: npx skills add https://github.com/hashimiche/hal --skill audit-hashimiche

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Enables management of Vault audit devices in the local HAL lab, including enabling, disabling, verifying, and explaining audit configurations to ensure observability and non-blocking operations.

Core Features & Use Cases

  • Enable or disable Vault audit logging and integration with Loki/Grafana for observability.
  • Verify mounted audit devices and their file targets, and inspect audit logs safely.
  • Troubleshoot blocked Vault behavior due to audit write failures and provide remediation guidance.

Quick Start

Enable Vault audit logging with HAL (optionally --loki) and verify the audit device state and log targets.

Frequently Asked Questions about audit

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I enable Vault audit logging and integrate it with Loki and Grafana?

To enable Vault audit logging, you can activate the audit device with an optional Loki integration, allowing you to route and visualize logs in Grafana for observability.

Why does Vault become blocked or unresponsive after an audit write failure?

Vault becomes blocked when an audit device fails to write logs, causing operations to halt. Troubleshooting involves verifying the audit device configuration and file targets to restore functionality.

How can I verify mounted Vault audit devices and inspect their log targets?

You can verify mounted Vault audit devices by checking the device state and inspecting the configured file targets to ensure audit logs are correctly captured and safely stored.

What steps are needed to troubleshoot offline Vault audit configurations?

Troubleshooting offline Vault audit configurations requires following edge-case handling guidance to verify device status, inspect file targets, and apply remediation steps for write failures.

Can I disable a Vault audit device without blocking other Vault operations?

Yes, you can disable a Vault audit device to ensure non-blocking operations by removing the failed logging target and restoring normal Vault functionality.