openstack-ansible-security/doc/source/developer-notes/V-38495.rst

The Ansible tasks will ensure that files in /var/log/audit are owned by the root user.