Audibeat access auditd time

Hi,

Does someone know what is time sequence that auditbeat is getting events from auditd?
Is it possible to reduce this time?

I made some testing if auditbeat is logging reboot commands for server - unsuccessfully. With same rules auditd is successfully log reboot command.

Thanks and best regards,
Luka

This topic was automatically closed 21 days after the last reply. New replies are no longer allowed.