Hi, Audit logs aren't in the same location than the xo-server logs. To get Audit logs you can use this command xo-cli audit.getRecords which returns an array of records. xo-cli audit.getRecords This command has an option ndjson, which allows you to export logs in a ndjson format. xo-cli audit.getRecords ndjson="json:true" @=<outputPath>