Skip to content

auditd: assign stable name to logfile input #21093

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
efd6 wants to merge 1 commit into
base: main
Choose a base branch
from
Draft

auditd: assign stable name to logfile input #21093

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 12 additions & 0 deletions packages/auditd/changelog.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,16 @@
# later versions go on top
- version: "3.25.0"
changes:
- description: >-
Assign a stable name to the logfile input so that Fleet can preserve
user-configured variables (paths, tags, processors) across the
logfile-to-filestream migration in the next release.
Upgrade note: the next release changes the input type from logfile to
filestream. To preserve custom variable values, upgrade to this version
first and confirm the policy is applied before upgrading further.
Do not skip this version.
type: enhancement
link: https://github.com/elastic/integrations/pull/21093
- version: "3.24.2"
changes:
- description: Fix quadratic grok backtracking in the raw pipeline on EXECVE records with oversized split arguments (aN[0], aN[1], ...), which could exceed the grok watchdog timeout and consume excessive ingest CPU. Bracket-suffixed argument chunk keys are now also captured instead of being dropped.
Expand Down
8 changes: 6 additions & 2 deletions ...auditd/data_stream/log/_dev/test/pipeline/test-auditd-preparsed-syscall.log-expected.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,10 +18,14 @@
"action": [
"executed"
],
"category": "process",
"category": [
"process"
],
"kind": "event",
"original": "type=SYSCALL msg=audit(1485893834.891:18877199): arch=c000003e syscall=59 success=yes exit=0 a0=7f095d0a4b88 ppid=1234 pid=5678 auid=1000 uid=0 gid=0 comm=\"ls\" exe=\"/bin/ls\"",
"type": "info"
"type": [
"info"
]
},
"host": {
"architecture": "x86_64"
Expand Down
40 changes: 30 additions & 10 deletions packages/auditd/data_stream/log/_dev/test/pipeline/test-auditd-raw.log-expected.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -374,11 +374,15 @@
"action": [
"booted-system"
],
"category": "host",
"category": [
"host"
],
"kind": "event",
"original": "type=SYSTEM_BOOT msg=audit(1573844456.144:5): pid=678 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm=\"systemd-update-utmp\" exe=\"/usr/lib/systemd/systemd-update-utmp\" hostname=? addr=? terminal=? res=success'",
"outcome": "success",
"type": "info"
"type": [
"info"
]
},
"process": {
"executable": "/usr/lib/systemd/systemd-update-utmp",
Expand Down Expand Up @@ -412,11 +416,15 @@
"action": [
"shutdown-system"
],
"category": "host",
"category": [
"host"
],
"kind": "event",
"original": "type=SYSTEM_SHUTDOWN msg=audit(1573844517.054:1163): pid=4440 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm=\"systemd-update-utmp\" exe=\"/usr/lib/systemd/systemd-update-utmp\" hostname=? addr=? terminal=? res=success'",
"outcome": "success",
"type": "info"
"type": [
"info"
]
},
"process": {
"executable": "/usr/lib/systemd/systemd-update-utmp",
Expand Down Expand Up @@ -508,11 +516,15 @@
"action": [
"issued-vm-control"
],
"category": "host",
"category": [
"host"
],
"kind": "event",
"original": "type=VIRT_CONTROL msg=audit(1513507481.075:145): pid=1431 uid=0 auid=100 ses=3 subj=system_u:system_r:container_runtime_t:s0 msg='user=root reason=api op=create vm=? vm-pid=? hostname=? exe=\"/usr/bin/dockerd-current\" addr=? terminal=? res=success'",
"outcome": "success",
"type": "creation"
"type": [
"start"
]
},
"process": {
"executable": "/usr/bin/dockerd-current",
Expand Down Expand Up @@ -561,11 +573,15 @@
"action": [
"assigned-vm-id"
],
"category": "host",
"category": [
"host"
],
"kind": "event",
"original": "type=VIRT_MACHINE_ID msg=audit(1481903143.572:23118): pid=5637 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:virtd_t:s0-s0:c0.c1023 msg='virt=kvm vm=\"rhel-work3\" uuid=5501263b-181d-47ed-ab03-a6066f3d26bf vm-ctx=system_u:system_r:svirt_t:s0:c444,c977 img-ctx=system_u:object_r:svirt_image_t:s0:c444,c977 model=selinux exe=\"/usr/sbin/libvirtd\" hostname=? addr=? terminal=? res=success'",
"outcome": "success",
"type": "creation"
"type": [
"info"
]
},
"process": {
"executable": "/usr/sbin/libvirtd",
Expand Down Expand Up @@ -728,11 +744,15 @@
"action": [
"booted-system"
],
"category": "host",
"category": [
"host"
],
"kind": "event",
"original": "node=localhost.localdomain type=SYSTEM_BOOT msg=audit(1594053514.725:7): pid=1667 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg=' comm=\"systemd-update-utmp\" exe=\"/usr/lib/systemd/systemd-update-utmp\" hostname=? addr=? terminal=? res=success'",
"outcome": "success",
"type": "info"
"type": [
"info"
]
},
"process": {
"executable": "/usr/lib/systemd/systemd-update-utmp",
Expand Down
3 changes: 0 additions & 3 deletions packages/auditd/data_stream/log/_dev/test/system/test-preparsed-config.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,3 @@
skip:
reason: "Requires Elastic Agent >= 9.5.0 with the go-libaudit auditd filestream parser (beats#50791). CI runs the package's minimum supported stack, which has neither the parser nor the Fleet semverSatisfies helper (needs Kibana >= 9.4). Un-skip once the test matrix can boot a >= 9.5 stack."
link: https://github.com/elastic/beats/pull/50791
data_stream:
vars:
use_auditd_parser: true
Expand Down
Loading
Loading