# Auditbeat tagging the events wrongly

**URL:** <https://discuss.elastic.co/t/auditbeat-tagging-the-events-wrongly/166682>\
**Category:** Beats\
**Tags:** auditbeat\
**Created:** [February 1, 2019, 6:57am UTC](https://discuss.elastic.co/t/auditbeat-tagging-the-events-wrongly/166682 "2019-02-01T06:57:47Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![arunpmohan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/arunpmohan/32/69467_2.png) [@arunpmohan](https://discuss.elastic.co/u/arunpmohan)\
**Post date:** [February 1, 2019, 6:57am UTC](https://discuss.elastic.co/t/auditbeat-tagging-the-events-wrongly/166682/1 "2019-02-01T06:57:48Z")

</div>

OS : Centos 7  
Version of Auditbeat : 6.4.0

Issue: When a file is modified, auditbeat used to tag it as "updated". But for some reason, it is updating as "created" only. Also file deletion events are not tagged too. Why is this happening.

Following is my auditbeat configuration  
########################## Auditbeat Configuration #############################  
#================================ General ======================================  
queue:  
mem:  
events: 4096  
flush:  
min\_events: 2048  
max\_procs: 1  
max\_start\_delay: 10s  
#================================= Paths ======================================  
path:  
home: "/usr/share/auditbeat"  
config: "/etc/auditbeat"  
data: "/var/lib/auditbeat"  
logs: "/var/log/auditbeat/auditbeat.log"  
#============================ Config Reloading ================================  
config:  
modules:  
path: ${path.config}/conf.d/\*.yml  
reload:  
period: 10s  
enabled: False  
#========================== Modules configuration =============================  
auditbeat.modules:

```
#----------------------------- Auditd module -----------------------------------
- module: auditd
  resolve_ids: True
  failure_mode: silent
  backlog_limit: 8196
  rate_limit: 0
  include_raw_message: True
  include_warnings: True
  audit_rules: |
    -w /etc/group -p wa -k identity
    -w /etc/passwd -p wa -k identity
    -w /etc/gshadow -p wa -k identity
    -w /etc/shadow -p wa -k identity
    -w /etc/security/opasswd -p wa -k identity
    -a always,exit -F arch=b64 -S open,creat,truncate,ftruncate,openat,open_by_handle_at -F exit=-EACCES -k access
    -a always,exit -F arch=b64 -S open,creat,truncate,ftruncate,openat,open_by_handle_at -F exit=-EPERM -k access
    -a always,exit -F dir=/home -F uid=0 -F auid>=1000 -F auid!=4294967295 -C auid!=obj_uid -F key=power-abuse
    -a always,exit -F arch=b64 -S setuid -F a0=0 -F exe=/usr/bin/su -F key=elevated-privs
    -a always,exit -F arch=b32 -S setuid -F a0=0 -F exe=/usr/bin/su -F key=elevated-privs
    -a always,exit -F arch=b64 -S setresuid -F a0=0 -F exe=/usr/bin/sudo -F key=elevated-privs
    -a always,exit -F arch=b32 -S setresuid -F a0=0 -F exe=/usr/bin/sudo -F key=elevated-privs
    -a always,exit -F arch=b64 -S execve -C uid!=euid -F euid=0 -F key=elevated-privs
    -a always,exit -F arch=b32 -S execve -C uid!=euid -F euid=0 -F key=elevated-privs

#----------------------------- File Integrity module -----------------------------------
- module: file_integrity
  paths:
    - /bin
    - /sbin
    - /usr/sbin
    - /usr/bin
    - /usr/local/bin
    - /usr/local/sbin
    - /opt/bin
    - /opt/sbin
    - /lib
    - /usr/lib
    - /usr/local/lib
    - /lib64
    - /usr/lib64
    - /etc/passwd
    - /etc/shadow
    - /etc/siemtest
    - /etc/auditbeat/auditbeat.yml
    - /etc/rsyslog.conf
    - /var/log/audit

  exclude_files:
    - (?i)\.sw[nop]$
    - ~$
    - /\.git($|/)
  scan_at_start: True
  scan_rate_per_sec: 50 MiB
  max_file_size: 100 MiB
  hash_types: [sha1]
  recursive: True
#-------------------------- Elasticsearch output -------------------------------
output.elasticsearch:
  enabled: True
  hosts:
    - x.x.x.x:9200
  compression_level: 0
  protocol: "http"
  worker: 1
  bulk_max_size: 50
  timeout: 90

```

I tested in the folder, "/lib" which is given in the file integrity module  
Can somebody give insights on the same.

---

<div class="post-metadata">

**Author:** ![adrisr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/adrisr/32/25423_2.png) [@adrisr](https://discuss.elastic.co/u/adrisr)\
**Post date:** [February 5, 2019, 1:57pm UTC](https://discuss.elastic.co/t/auditbeat-tagging-the-events-wrongly/166682/2 "2019-02-05T13:57:56Z")

</div>

Hi,

Getting a `created` or `updated` event on an existing file depends on how the file is updated. Some editors delete the original file and then create it with the new contents. In this scenario, you will get a `delete` and `create` event instead of an `update` event.

Is that the case? Can you give an example scenario where you are observing wrong events?

> Also file deletion events are not tagged too.

I don't understand what you mean here. Can you give an example?

---

<div class="post-metadata">

**Author:** ![arunpmohan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/arunpmohan/32/69467_2.png) [@arunpmohan](https://discuss.elastic.co/u/arunpmohan)\
**Post date:** [February 26, 2019, 11:56am UTC](https://discuss.elastic.co/t/auditbeat-tagging-the-events-wrongly/166682/3 "2019-02-26T11:56:25Z")

</div>

Hi,  
I understand what you said about the created/updated scenario.  
So if we want to listen for files under a folder for the modification of files under them, how can we proceed?. Is file integrity the right module for the same?.  
Or do we need to write auditd rules on that folder for auditbeat?.  
Also, any other option we have here?

---

<div class="post-metadata">

**Author:** ![adrisr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/adrisr/32/25423_2.png) [@adrisr](https://discuss.elastic.co/u/adrisr)\
**Post date:** [February 27, 2019, 1:15pm UTC](https://discuss.elastic.co/t/auditbeat-tagging-the-events-wrongly/166682/4 "2019-02-27T13:15:17Z")

</div>

> So if we want to listen for files under a folder for the modification of files under them, how can we proceed?. Is file integrity the right module for the same?.

Yes, `file_integrity` is the right module to use.

Can you share the debug logs (run auditbeat with `-d '*'` flag) of the case where you're not getting an update event? Describe how you updated the file.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 20, 2019, 1:15pm UTC](https://discuss.elastic.co/t/auditbeat-tagging-the-events-wrongly/166682/5 "2019-03-20T13:15:18Z")

</div>

This topic was automatically closed 21 days after the last reply. New replies are no longer allowed.