# Correlation between auditd and system module

**URL:** <https://discuss.elastic.co/t/correlation-between-auditd-and-system-module/236691>\
**Category:** Beats\
**Tags:** auditbeat\
**Created:** [June 11, 2020, 11:42am UTC](https://discuss.elastic.co/t/correlation-between-auditd-and-system-module/236691 "2020-06-11T11:42:44Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![marcus\_lhisp](https://avatars.discourse-cdn.com/v4/letter/m/4da419/32.png) [@marcus\_lhisp](https://discuss.elastic.co/u/marcus_lhisp)\
**Post date:** [June 11, 2020, 11:42am UTC](https://discuss.elastic.co/t/correlation-between-auditd-and-system-module/236691/1 "2020-06-11T11:42:45Z")

</div>

Hey folks,

I began asking myself if the system module which handles stuff like login, packages, etc. actually obsoletes some of my auditd rules? Or do they only the same thing but in a different manner?

My rules that I am deploying are auditing some files and folders and a lot of SYSCALLS. The documentation of each element in the system module haven't a lot on info on that what's actually running behind the scenes. But maybe that's a system of the fact that those are still Beta.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 9, 2020, 1:42pm UTC](https://discuss.elastic.co/t/correlation-between-auditd-and-system-module/236691/2 "2020-07-09T13:42:46Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.