diff --git a/CMakeLists.txt b/CMakeLists.txt
index 52b05637f..472135fbe 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -1,5 +1,9 @@
 cmake_minimum_required(VERSION 3.5.0 FATAL_ERROR) #CPACK_DEBIAN_<COMPONENT>_PACKAGE_NAME
 
+# Ensure try_compile() uses project settings
+cmake_policy(SET CMP0066 NEW)
+cmake_policy(SET CMP0067 NEW)
+
 find_package(IRODS 4.3.0 EXACT REQUIRED)
 set(IRODS_PLUGIN_REVISION "1")
 set(IRODS_PLUGIN_VERSION "${IRODS_VERSION}.${IRODS_PLUGIN_REVISION}")
@@ -31,6 +35,7 @@ include(${IRODS_TARGETS_PATH})
 
 include(GNUInstallDirs)
 include(UseLibCXX)
+include(CheckCXXSymbolExists)
 
 find_package(Threads REQUIRED)
 find_package(OpenSSL REQUIRED COMPONENTS Crypto SSL)
@@ -61,6 +66,15 @@ target_link_libraries(
   dl
   )
 
+check_cxx_symbol_exists(__cpp_lib_filesystem "version" HAVE_STD_FILESYSTEM)
+if (NOT HAVE_STD_FILESYSTEM)
+  target_link_libraries(
+    ${PLUGIN}
+    PRIVATE
+    ${IRODS_EXTERNALS_FULLPATH_BOOST}/lib/libboost_filesystem.so
+    )
+endif()
+
 install(TARGETS ${PLUGIN} LIBRARY DESTINATION ${IRODS_PLUGINS_DIRECTORY}/rule_engines)
 
 install(
diff --git a/libirods_rule_engine_plugin-audit_amqp.cpp b/libirods_rule_engine_plugin-audit_amqp.cpp
index 5b06a0587..2ecd0176a 100644
--- a/libirods_rule_engine_plugin-audit_amqp.cpp
+++ b/libirods_rule_engine_plugin-audit_amqp.cpp
@@ -18,7 +18,6 @@
 #include <boost/algorithm/string.hpp>
 #include <boost/archive/iterators/base64_from_binary.hpp>
 #include <boost/archive/iterators/transform_width.hpp>
-#include <boost/format.hpp>
 
 // proton-cpp includes
 #include <proton/connection.hpp>
@@ -49,6 +48,17 @@
 #include <mutex>
 #include <regex>
 
+// filesystem
+// clang-format off
+#ifdef __cpp_lib_filesystem
+#include <filesystem>
+namespace fs = std::filesystem;
+#else
+#include <boost/filesystem.hpp>
+namespace fs = boost::filesystem;
+#endif
+// clang-format on
+
 namespace
 {
 	const auto pep_regex_flavor = std::regex::ECMAScript;
@@ -57,17 +67,18 @@ namespace
 	const std::string_view default_pep_regex_to_match{"audit_.*"};
 	const std::string_view default_amqp_url{"localhost:5672/irods_audit_messages"};
 
-	const std::string_view default_log_path_prefix{"/tmp"};
+	const fs::path default_log_path_prefix{fs::temp_directory_path()};
 	const bool default_test_mode = false;
 
 	std::string audit_pep_regex_to_match;
 	std::string audit_amqp_url;
 
-	std::string log_path_prefix;
+	fs::path log_path_prefix;
 	bool test_mode;
 
 	bool warned_amqp_options = false;
 
+	fs::path log_file_path;
 	std::ofstream log_file_ofstream;
 
 	// audit_pep_regex is initially populated with an unoptimized default, as optimization
@@ -352,7 +363,6 @@ namespace
 		nlohmann::json json_obj;
 
 		std::string msg_str;
-		std::string log_file;
 
 		try {
 			std::uint64_t time_ms = ts_clock::now().time_since_epoch() / std::chrono::milliseconds(1);
@@ -365,8 +375,8 @@ namespace
 			json_obj["action"] = "START";
 
 			if (test_mode) {
-				log_file = str(boost::format("%s/%06i.txt") % log_path_prefix % pid);
-				json_obj["log_file"] = log_file;
+				log_file_path = log_path_prefix / fmt::format(FMT_STRING("{0:08d}.txt"), pid);
+				json_obj["log_file"] = log_file_path;
 			}
 		}
 		catch (const irods::exception& e) {
@@ -390,7 +400,9 @@ namespace
 		proton::container(handler).run();
 
 		if (test_mode) {
-			log_file_ofstream.open(log_file);
+			if (!log_file_ofstream.is_open()) {
+				log_file_ofstream.open(log_file_path);
+			}
 			log_file_ofstream << msg_str << std::endl;
 		}
 
@@ -411,14 +423,11 @@ namespace
 			json_obj["@timestamp"] = time_ms;
 
 			json_obj["hostname"] = boost::asio::ip::host_name();
-
-			pid_t pid = getpid();
-			json_obj["pid"] = pid;
-
+			json_obj["pid"] = getpid();
 			json_obj["action"] = "STOP";
 
 			if (test_mode) {
-				json_obj["log_file"] = str(boost::format("%s/%06i.txt") % log_path_prefix % pid);
+				json_obj["log_file"] = log_file_path;
 			}
 		}
 		catch (const irods::exception& e) {
@@ -442,6 +451,9 @@ namespace
 		proton::container(handler).run();
 
 		if (test_mode) {
+			if (!log_file_ofstream.is_open()) {
+				log_file_ofstream.open(log_file_path);
+			}
 			log_file_ofstream << msg_str << std::endl;
 			log_file_ofstream.close();
 		}
@@ -576,6 +588,9 @@ namespace
 		proton::container(handler).run();
 
 		if (test_mode) {
+			if (!log_file_ofstream.is_open()) {
+				log_file_ofstream.open(log_file_path);
+			}
 			log_file_ofstream << msg_str << std::endl;
 		}