When the Storm Ranger plugin sends audit logs to a file via Log4jAuditProvider, a specific configuration must be used.

<appenders>
....
  <RollingFile name="STORMAUDIT"
                 fileName="${sys:storm.log.dir}/ranger_audit.log"
                 filePattern="${sys:storm.log.dir}/ranger_audit.log.%i">
        <PatternLayout>
            <pattern>${pattern}</pattern>
        </PatternLayout>
        <Policies>
            <SizeBasedTriggeringPolicy size="100 MB"/> <!-- Or every 100 MB -->
        </Policies>
        <DefaultRolloverStrategy max="9"/>
    </RollingFile>
    <Loggers>
    	......

      <Logger name="xaaudit" level="info">
        <AppenderRef ref="STORMAUDIT"/>
     </Logger>
    </Loggers>
</appenders>

Storm uses log4j2 format for log4j configurations. In log4j.xml, the name of the logger (in this case, “xaaudit”) is needed and not the whole class name with logger name; this is handled by the <Logger> tag.