I have installed auditbeat on an Ubuntu Linux 18.04 VM. I am using the recommended audit.rules config from the CIS benchmarks.
When auditbeat is running, it consistently consumes 40-60% of a core. The native Linux audit daemon runs at less than 1%.
I'm new to auditbeat. How do I go about troubleshooting performance issues like this?
Thanks in advance!