Hi,

Audit logs aren't in the same location than the xo-server logs.

To get Audit logs you can use this command xo-cli audit.getRecords which returns an array of records.

xo-cli audit.getRecords

This command has an option ndjson, which allows you to export logs in a ndjson format.

xo-cli audit.getRecords ndjson="json:true" @=<outputPath>