We are having trouble with our azure servers.
We are using the Azure Security Centre and Update Manager to keep our servers up to 'snuff'.
We use the OMSagent for Linux to keep an eye on what is going on.
OMSagent needs auditd to actually work - its a dependency of the style 'not there, not gonna start...'
However for numerous other reason, I am having to look to see if we can get auditbeats up and running.
It seems to me be pretty cut and dried...
Stop auditd / start auditbeats and omsagent fails.
Has anyone had any luck getting auditbeats and auditd to play together happily? ( although that is a nonsensical request in my mind...)