Hi everyone,
Not sure what I am doing wrong here, but it seems to me that auditbeat is correctly configured although it does not send anything to ElasticSearch.
Here's my auditbeat logs:
2018/08/03 16:12:45.328929 beat.go:260: INFO auditbeat start running.
2018/08/03 16:12:45.329013 wrapper.go:98: DBG Starting Wrapper[name=audit, len(metricSetWrappers)=1]
2018/08/03 16:12:45.329082 wrapper.go:98: DBG Starting Wrapper[name=audit, len(metricSetWrappers)=1]
2018/08/03 16:12:45.329139 wrapper.go:164: DBG audit/kernel will start after 1.600942072s
2018/08/03 16:12:45.329166 wrapper.go:164: DBG audit/file will start after 4.738901871s
2018/08/03 16:12:46.930387 wrapper.go:172: DBG Starting metricSetWrapper[module=audit, name=kernel, host=]
2018/08/03 16:12:46.949965 audit_linux.go:163: INFO [audit.kernel] Deleted 184 pre-existing audit rules.
2018/08/03 16:12:47.116885 audit_linux.go:177: INFO [audit.kernel] Successfully added 184 of 184 kernel audit rules.
2018/08/03 16:12:47.117081 audit_linux.go:197: DBG [audit.kernel] audit status from kernel at start: status=&{Mask:0 Enabled:1 Failure:0 PID:708 RateLimit:0 BacklogLimit:8192 Lost:0 Backlog:0 FeatureBitmap:61 BacklogWaitTime:0}
2018/08/03 16:12:50.068380 wrapper.go:172: DBG Starting metricSetWrapper[module=audit, name=file, host=]
2018/08/03 16:13:15.307816 metrics.go:39: INFO Non-zero metrics in the last 30s: beat.memstats.gc_next=4521792 beat.memstats.memory_alloc=2427960 beat.memstats.memory_total=11299032 libbeat.config.module.running=0 libbeat.output.type=elasticsearch libbeat.pipeline.clients=2 libbeat.pipeline.events.active=0
2018/08/03 16:13:45.307811 metrics.go:39: INFO Non-zero metrics in the last 30s: beat.memstats.gc_next=4521792 beat.memstats.memory_alloc=2438136 beat.memstats.memory_total=11309208 libbeat.config.module.running=0 libbeat.pipeline.clients=2 libbeat.pipeline.events.active=0
2018/08/03 16:14:15.307892 metrics.go:39: INFO Non-zero metrics in the last 30s: beat.memstats.gc_next=4521792 beat.memstats.memory_alloc=2448856 beat.memstats.memory_total=11319928 libbeat.config.module.running=0 libbeat.pipeline.clients=2 libbeat.pipeline.ev
that last line just goes on in a loop....
When I test ElasticSearch, I see that I don't get any logs going through:
[root@ELK auditbeat]# curl -XGET 'http://0.0.0.0:9200/auditbeat-*/_search?pretty'
{
"took" : 0,
"timed_out" : false,
"_shards" : {
"total" : 0,
"successful" : 0,
"skipped" : 0,
"failed" : 0
},
"hits" : {
"total" : 0,
"max_score" : 0.0,
"hits" : [ ]
}
}
However, the YAML file for auditbeat specifically says:
#-------------------------- Elasticsearch output ------------------------------
output.elasticsearch:
# Array of hosts to connect to.
hosts: ["0.0.0.0:9200"]
# Optional protocol and basic auth credentials.
#protocol: "https"
#username: "elastic"
#password: "changeme"
#----------------------------- Logstash output --------------------------------
#output.logstash:
# The Logstash hosts
#hosts: ["localhost:5044"]
And as you can see, logstash is disabled. I've not bothered installing at as it is apparently not necessary(I don't have a large volume of servers right now, just testing)
So, is that possible to send all auditd logs straight to ElasticSearch or maybe I must install logstash if I want to use beats ?
Thanks,
I tried using the proper IP too instead of the loopback interface, and it indeed helped getting rid of those messages. However, I still see no index in Kibana.