Auditbeat failed to load rules on aarch64/ARM 64 bits

Elastic Stack Beats
1

Hi sir,

When I try to load the following rules on aarch64 platform (ARM 64 bits)

-a always,exit -F arch=b64 -S open,creat,truncate,ftruncate,openat,open_by_handle_at -F exit=-EACCES -k access
-a always,exit -F arch=b64 -S open,creat,truncate,ftruncate,openat,open_by_handle_at -F exit=-EPERM -k access

I get the following errors and auditbeat doesn't start:

Exiting: 1 error: 1 error: failed to unpack the auditd config: 1 error: failed loading rules: 2 errors: at (audit_rules at auditbeat.yml):23:
failed to interpret rule '-a always,exit -F arch=b64 -S open,creat,truncate,ftruncate,openat,open_by_handle_at -F exit=-EACCES -k access': failed to add syscall 'open': unknown syscall 'open' for arch aarch64; at (audit_rules at auditbeat.yml):24:
failed to interpret rule '-a always,exit -F arch=b64 -S open,creat,truncate,ftruncate,openat,open_by_handle_at -F exit=-EPERM -k access':
failed to add syscall 'open': unknown syscall 'open' for arch aarch64 accessing 'auditbeat.modules.0' (source:'auditbeat.yml’)

Use arch=b32 or comment out them for now. How to solve or work around this issue if arch=b64.

Thanks very much

Albert

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.