Audibeat access auditd time


Does someone know what is time sequence that auditbeat is getting events from auditd?
Is it possible to reduce this time?

I made some testing if auditbeat is logging reboot commands for server - unsuccessfully. With same rules auditd is successfully log reboot command.

Thanks and best regards,

This topic was automatically closed 21 days after the last reply. New replies are no longer allowed.