Everything is working.  Here's the final config I used : In the logging safety valve of the namenode service hdfs.audit.logger=${log.threshold},RFAAUDIT,SYSLOG log4j.appender.SYSLOG=org.apache.log4j.net.SyslogAppender log4j.appender.SYSLOG.syslogHost=localhost log4j.appender.SYSLOG.layout=org.apache.log4j.PatternLayout log4j.appender.SYSLOG.layout.ConversionPattern=%d{ISO8601} %p %c: %m%n log4j.appender.SYSLOG.Facility=LOCAL1 And the Env Variable Safety Valve (System Wide)   HADOOP_AUDIT_LOGGER=INFO,RFAAUDIT,SYSLOG   Thx for the help.   This case is closed 😄 ... View more