diff --git a/pkg/cluster/audit/audit.go b/pkg/cluster/audit/audit.go
index cb52521f3e..e5154acb44 100644
--- a/pkg/cluster/audit/audit.go
+++ b/pkg/cluster/audit/audit.go
@@ -132,7 +132,7 @@ func GetAuditList(dir string) ([]Item, error) {
 	}
 
 	sort.Slice(auditList, func(i, j int) bool {
-		return auditList[i].Time > auditList[j].Time
+		return auditList[i].Time < auditList[j].Time
 	})
 
 	return auditList, nil
diff --git a/pkg/cluster/audit/audit_test.go b/pkg/cluster/audit/audit_test.go
index 0ae82fa2ac..75ebefd8ec 100644
--- a/pkg/cluster/audit/audit_test.go
+++ b/pkg/cluster/audit/audit_test.go
@@ -118,11 +118,11 @@ func (s *testAuditSuite) TestShowAuditLog(c *C) {
 	// tabby table size is based on column width, while time.RFC3339 maybe print out timezone like +08:00 or Z(UTC)
 	// skip the first two lines
 	list := strings.Join(strings.Split(readFakeStdout(f), "\n")[2:], "\n")
-	c.Assert(list, Equals, fmt.Sprintf(`ftmpqzww84Q  %s  test with nanosecond
-4F7ZTL       %s  test with second
+	c.Assert(list, Equals, fmt.Sprintf(`4F7ZTL       %s  test with second
+ftmpqzww84Q  %s  test with nanosecond
 `,
-		time.Unix(nanoSecond/1e9, 0).Format(time.RFC3339),
 		time.Unix(second, 0).Format(time.RFC3339),
+		time.Unix(nanoSecond/1e9, 0).Format(time.RFC3339),
 	))
 	f.Close()