> For the complete documentation index, see [llms.txt](https://docs.blusapphire.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.blusapphire.io/log-forwarding/03_log-forwarding-guide/log-forward/linux.md).

# Linux

## To forward Audit logs using auditbeat:

Install auditbeat package by executing the below command:

curl -Ls [https://prod1-us.blusapphire.net/export/install/scripts/install-auditbeat.sh](https://www.google.com/url?q=https%3A%2F%2Fprod1-us.blusapphire.net%2Fexport%2Finstall%2Fscripts%2Finstall-auditbeat.sh\&sa=D\&ust=1747229340000000\&usg=AOvVaw1H7gYYydBuCt0OnsMB0r1W) | sudo bash -s -- --client\_id "\<clientid>" --collector\_ip "\<collectorip>" --collector\_port "12514"

Note: This package holds pre-defined audit rules as per the audit recommendations.