diff --git a/roles/base/files/rsyslog/rsyslog-audit.conf.cloud b/roles/base/files/rsyslog/rsyslog-audit.conf.cloud
new file mode 100644
index 0000000000..1b99256360
--- /dev/null
+++ b/roles/base/files/rsyslog/rsyslog-audit.conf.cloud
@@ -0,0 +1 @@
+# we do not offer log servers in the cloud
diff --git a/roles/base/files/rsyslog/rsyslog-audit.conf b/roles/base/files/rsyslog/rsyslog-audit.conf.default
similarity index 100%
rename from roles/base/files/rsyslog/rsyslog-audit.conf
rename to roles/base/files/rsyslog/rsyslog-audit.conf.default
diff --git a/roles/base/tasks/main.yml b/roles/base/tasks/main.yml
index aad1619405..372bed7f28 100644
--- a/roles/base/tasks/main.yml
+++ b/roles/base/tasks/main.yml
@@ -276,6 +276,19 @@
   - config
   - base
 
+- name: rsyslog-audit.conf
+  copy: src={{ item }} dest=/etc/rsyslog.d/rsyslog-audit.conf owner=root group=root mode=0644
+  with_first_found:
+    - rsyslog/rsyslog-audit.conf.{{ datacenter }}
+    - rsyslog/rsyslog-audit.conf.default
+  notify:
+  - restart rsyslog
+  tags:
+  - rsyslogd
+  - config
+  - base
+
+- name: remove
 - name: log everything to log01 except on mirrorlist, do not log local4 there.
   copy: src=rsyslog/rsyslog-log01 dest=/etc/rsyslog.d/rsyslog-log01.conf mode=0644
   when: not inventory_hostname.startswith(('mirrorlist','copr'))