HVD: vault: enrich audit device guidance with schema reference and two-device setup (HVD-1830)

[danbr-ibm]

Summary

Addresses two customer pain points in the Vault Initial Configuration HVD, surfaced via FRB-6800 (Honeywell, BCG, 7+ enterprise accounts, $30M+ signal) and VSM-226:

1. Missing audit log field dictionary - SIEM engineers building integrations in Splunk/Datadog had no field-level reference for the JSON log structure. Customers had already found the upstream schema docs and found them insufficient.
2. Insufficient two-device configuration guidance - the existing HVD said to configure two devices but didn't say which two, why, or answer the common follow-up questions (does it double I/O? which disk? what options?).

Source PR being migrated: https://github.com/hashicorp/hvd-docs/pull/387

Changes

Updated files:

• content/validated-designs/docs/docs/vault/installation-guide/vms/post-installation-configuration.mdx
• content/validated-designs/docs/docs/vault/administration-guide/monitoring-and-observability.mdx

Main guidance themes migrated:

• Device type descriptions with stronger recommendations for file, syslog, and socket audit devices
• Recommended two-device setup using file plus syslog
• Recommended enable commands including elide_list_responses=true and hmac_accessor=false
• Verification step using vault audit list
• Enterprise audit device features including filtering, fallback devices, and entry exclusion
• Audit log entry schema reference with top-level, authentication, and request object fields

Notes

This is a draft PR created as part of the HVD migration from hashicorp/hvd-docs into hashicorp/web-unified-docs. The content is being moved as-is in draft form so any follow-up review and cleanup can happen in the correct repository.

[github-actions]

Vercel Previews Deployed

Name	Status	Preview	Updated (UTC)
Dev Portal	✅ Ready (Inspect)	Visit Preview	Tue Aug 11 15:22:47 UTC 2026
Unified Docs API	✅ Ready (Inspect)	Visit Preview	Tue Aug 11 15:18:02 UTC 2026

[github-actions]

Broken Link Checker

This PR contains broken links, but won't be blocked. Use this report to improve content quality:

Quick Actions

• Internal links (HashiCorp sites): Please fix these - they impact user experience
• External links: Consider if these are essential or can be updated/removed
• Temporary issues: External sites may recover - check again before merging

Need Help?

• Review our Broken Link Monitoring docs
• Check the monthly production report for context

---

Internal Links

Full Github Actions output

External Links

Summary

Status	Count
🔍 Total	52
✅ Successful	6
⏳ Timeouts	0
🔀 Redirected	3
👻 Excluded	43
❓ Unknown	0
🚫 Errors	0
⛔ Unsupported	0

Redirects per input

Redirects in content/validated-designs/docs/docs/vault/administration-guide/monitoring-and-observability.mdx

• [200] https://learn.hashicorp.com/tutorials/vault/monitor-telemetry-audit-splunk | Redirect: Followed 1 redirect resolving to the final status of: OK. Redirects: https://learn.hashicorp.com/tutorials/vault/monitor-telemetry-audit-splunk --[308]--> https://developer.hashicorp.com/vault/tutorials/monitoring/monitor-telemetry-audit-splunk
• [200] https://learn.hashicorp.com/tutorials/vault/monitor-telemetry-grafana-prometheus | Redirect: Followed 2 redirects resolving to the final status of: OK. Redirects: https://learn.hashicorp.com/tutorials/vault/monitor-telemetry-grafana-prometheus --[308]--> https://developer.hashicorp.com/vault/tutorials/monitoring/monitor-telemetry-grafana-prometheus --[308]--> https://developer.hashicorp.com/vault/tutorials/archive/monitor-telemetry-grafana-prometheus

Redirects in content/validated-designs/docs/docs/vault/installation-guide/vms/post-installation-configuration.mdx

• [200] http://man7.org/linux/man-pages/man7/capabilities.7.html | Redirect: Followed 1 redirect resolving to the final status of: OK. Redirects: http://man7.org/linux/man-pages/man7/capabilities.7.html --[301]--> https://man7.org/linux/man-pages/man7/capabilities.7.html

Full Github Actions output