Error when enabling Kibana ECS Audit

Hi All,

We recently upgraded to ES v7.11.2 and would like to use the auditing features in Kibana to monitor the usage of various dashboards by various logins. etc.

I tried to enable auditing in my local setup in macOS using below steps:

  1. Installed gz package
  2. Enabled 30 days trial so that x-pack is enabled
  3. Enabled audit: xpack.security.audit.enabled: true
  4. Added the below default settings which are mentioned in the guide:
xpack.security.audit.appender:
  type: rolling-file
  fileName: ./audit.log
  policy:
    type: time-interval
    interval: 24h 
  strategy:
    type: numeric
    max: 10 
  layout:
    type: json

Kibana was unable to start after adding these bits. The errors I am getting:

log   [22:42:48.442] [fatal][root] TypeError: undefined is not iterable (cannot read property Symbol(Symbol.iterator))
    at LiteralType.handleError (KIBANA_HOME/node_modules/@kbn/config-schema/target/out/types/literal_type.js:17:25)
    at LiteralType.onError (KIBANA_HOME/node_modules/@kbn/config-schema/target/out/types/type.js:69:40)
    at type.<anonymous> (KIBANA_HOME/node_modules/@kbn/config-schema/target/out/types/type.js:41:53)
    at finish (KIBANA_HOME/node_modules/joi/lib/types/any/index.js:529:50)
    at type._validate (KIBANA_HOME/node_modules/joi/lib/types/any/index.js:585:20)
    at type._base (KIBANA_HOME/node_modules/joi/lib/types/object/index.js:212:45)
    at type._validate (KIBANA_HOME/node_modules/joi/lib/types/any/index.js:614:37)
    at internals.Alternatives._base (KIBANA_HOME/node_modules/joi/lib/types/alternatives/index.js:60:40)
    at internals.Alternatives._validate (KIBANA_HOME/node_modules/joi/lib/types/any/index.js:614:37)
    at type._base (KIBANA_HOME/node_modules/joi/lib/types/object/index.js:212:45)
    at type._validate (KIBANA_HOME/node_modules/joi/lib/types/any/index.js:614:37)
    at type._base (KIBANA_HOME/node_modules/joi/lib/types/object/index.js:212:45)
    at type._validate (KIBANA_HOME/node_modules/joi/lib/types/any/index.js:614:37)
    at type._validateWithOptions (KIBANA_HOME/node_modules/joi/lib/types/any/index.js:674:29)
    at module.exports.internals.Any.root.validate (KIBANA_HOME/node_modules/joi/lib/index.js:146:23)
    at ObjectType.validate (KIBANA_HOME/node_modules/@kbn/config-schema/target/out/types/type.js:46:72)

 FATAL  TypeError: undefined is not iterable (cannot read property Symbol(Symbol.iterator))

Is this due to incompatible version of NodeJS or some missing plugins ? I also tried using the flat structure of YAML, but getting the same error.

Can someone please suggest any solutions to this ?

Thank you

Hello Preetish,

Just a guess at this point but have you tried providing an absolute path for fileName? Something like /full/path/to/file/audit.log using whatever your full path is.

Regards,
Aaron

Hi @Aaron_Caldwell

Tried absolute path in fileName, still getting the same error.

Thanks