Anyone got auditbeat woring in azure with OMS Agent working

[stwilliams (Stuart Williams)]

Hi
We are having trouble with our azure servers.
We are using the Azure Security Centre and Update Manager to keep our servers up to 'snuff'.
We use the OMSagent for Linux to keep an eye on what is going on.
OMSagent needs auditd to actually work - its a dependency of the style 'not there, not gonna start...'

However for numerous other reason, I am having to look to see if we can get auditbeats up and running.

It seems to me be pretty cut and dried...
Stop auditd / start auditbeats and omsagent fails.

Has anyone had any luck getting auditbeats and auditd to play together happily? ( although that is a nonsensical request in my mind...)

[andrewkroh]

If you need to keep auditd running then you can try configuring Auditbeat to use a multicast socket to receive data. This frees up the one and only unicast socket for auditd to use.

Read through the docs at https://www.elastic.co/guide/en/beats/auditbeat/7.x/auditbeat-module-auditd.html.

auditbeat.modules:
- module: auditd
  socket_type: multicast

In this mode Auditbeat will not configure rules because auditd should have that responsibility. You don't want them to both be writing rules to kernel because they could conflict.