VQL Reference Event Plugins watch_auditd watch_auditd Plugin Arg Description Type filename A list of log files to parse. list of OSPath (required) accessor The accessor to use. string buffer_size Maximum size of line buffer. int Required permissions: MACHINE_STATE Description Watch log files generated by auditd.