Auditbeat do not delete correctly

Tester854 · February 21, 2022, 9:27pm

Hi,

I noticed that deleting auditbeat with the parameter (backspressure_strategy:kernel) audit rules continue to work. There are events from them in dmesg.

How to remove auditbeat using (backspressure_strategy:kernel) properly?
How to do this without restarting the system?

I found a ticket with this problem, but it is close

github.com/elastic/beats

[Auditbeat] Allow flushing of auditd rules

opened 07:16AM - 11 Sep 18 UTC

kholia

enhancement Auditbeat Team:SIEM Stalled

Auditbeat doesn't flush auditd rules upon daemon exit. This leads to `/var/log/k…ern.log` getting flooded with all the audit messages. Furthermore, it seems that auditbeat doesn't have a CLI option to flush the auditd rules. It seems that auditd too doesn't flush rules on daemon exit. ``` # systemctl start auditd # auditctl -l No rules # auditctl -a always,exit -F arch=b64 -S adjtimex -S settimeofday -k time_change # auditctl -l -a always,exit -F arch=b64 -S adjtimex,settimeofday -F key=time_change # systemctl stop auditd # auditctl -l -a always,exit -F arch=b64 -S adjtimex,settimeofday -F key=time_change ``` If flushing rules on daemon exit is not appropriate, then the auditbeat CLI shoould at least provide a way to flush the rules manually. Details, - Version: Auditbeat 6.4.0 - Operating System: Ubuntu 16.04 LTS / 18.04 LTS

system · March 21, 2022, 11:27pm

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.