Fluented Problems exist in collecting the Linux Audit Log

[ghost]

`

@type tail path /var/log/audit/audit.log read_from_head true pos_file /var/log/os/auditTest.log.pos tag syslog.audit @type none

<match syslog.audit.**>
@type file
path /var/log/testAuditLog

`
When I use this configuration, I notice that the log file keeps growing, but /var/log/audit/audit.log does not change much, and checking Td-agent. log finds: detected rotation of /var/log/audit/audit.log; waiting 5 seconds