Auditbeat Not Sending -k tags

Elastic Stack Beats
1

I've just set up auditbeat on a RHEL8 box to log various commands.
In the 'audit.rules.d' directory I've added a new file with entries such as:
-a always,exit -F path=/usr/bin/wget -F perm=x -k external_call

Running ausearch -k external_call reports correctly.

If I look in Kibana, the "tags" field isn't even listed as an option in the "Available Fields" column.

How can I tell where the breakdown is for the -k tags not being sent to ES?

2

Seems to be an issue with running auditd and auditbeat.
From what I had read, if you have a new enough kernel, this shouldn't be an issue, but seems to be.

If I stop auditd and restart auditbeat, tags are sent correctly.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.