All audit logs must be group owned by root user. The path for audit log can
be configured via log_file parameter in /etc/audit/auditd.conf
or, by default, the path for audit log is /var/log/audit/
.
To properly set the group owner of /var/log/audit/*, run the command:
$ sudo chgrp root /var/log/audit/*