# Configure module Auditd with Kubectl \[Auditbeat 7.9.2\]

**URL:** <https://discuss.elastic.co/t/configure-module-auditd-with-kubectl-auditbeat-7-9-2/267048>\
**Category:** Beats\
**Tags:** auditbeat\
**Created:** [March 12, 2021, 7:50am UTC](https://discuss.elastic.co/t/configure-module-auditd-with-kubectl-auditbeat-7-9-2/267048 "2021-03-12T07:50:30Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![RdrgPorto](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rdrgporto/32/13278_2.png) [@RdrgPorto](https://discuss.elastic.co/u/RdrgPorto)\
**Post date:** [March 12, 2021, 7:50am UTC](https://discuss.elastic.co/t/configure-module-auditd-with-kubectl-auditbeat-7-9-2/267048/1 "2021-03-12T07:50:30Z")

</div>

Hi, everyone

I have been working with module [Audit Module](https://www.elastic.co/guide/en/beats/auditbeat/current/auditbeat-module-auditd.html#audit-rules) in order to log any execution of [kubectl](https://kubernetes.io/docs/reference/kubectl/overview/).

Here you are my config:

```auto
auditbeat.modules:
- module: auditd
  audit_rules: |
    -a always,exit -F exe=/usr/bin/kubectl -F arch=b64 -S execve -k kubectl

logging.level: warning
logging.to_files: true
logging.files:
  path: /var/log/auditbeat
  name: auditbeat
  keepfiles: 3

output.kafka:
  hosts: ["<ip>:<port>"]
  topic: "<topic-name>"

```

It logs any execution of **kubectl** , however it logs more things, like when I do **sudo**. Is it normal this behaviour ?

 ![auditbeat-kubectl](https://us1.discourse-cdn.com/elastic/original/3X/3/e/3e42a7b1d75a0b60a14598bdfe40a0c9652d21e8.png)

Thanks in advance,

Rodrigo

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [March 15, 2021, 2:19pm UTC](https://discuss.elastic.co/t/configure-module-auditd-with-kubectl-auditbeat-7-9-2/267048/2 "2021-03-15T14:19:27Z")

</div>

That's normal. Auditbeat receives all of the audit messages from the kernel. So in addition to messages caused by your rules you'll be getting messages from apps that publish audit messages (like sshd and sudo).

You can write rules to drop these messages in the kernel if you don't want them (e.g. `-a always,exclude -F msgtype=FOO`). Or you could use a beats `drop_event` [processor](https://www.elastic.co/guide/en/beats/auditbeat/current/defining-processors.html) to drop them after Auditbeat receives it from kernel.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 12, 2021, 4:20pm UTC](https://discuss.elastic.co/t/configure-module-auditd-with-kubectl-auditbeat-7-9-2/267048/3 "2021-04-12T16:20:03Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.