# Filebeat auditd module

**URL:** <https://discuss.elastic.co/t/filebeat-auditd-module/148150>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [September 11, 2018, 1:52pm UTC](https://discuss.elastic.co/t/filebeat-auditd-module/148150 "2018-09-11T13:52:44Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Vijayakumar\_Kannan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vijayakumar_kannan/32/34873_2.png) [@Vijayakumar\_Kannan](https://discuss.elastic.co/u/Vijayakumar_Kannan)\
**Post date:** [September 11, 2018, 1:52pm UTC](https://discuss.elastic.co/t/filebeat-auditd-module/148150/1 "2018-09-11T13:52:44Z")

</div>

## Filebeat auditd module

Enabled the filebeat auditd module but the events are not parsing .

```auto
Provided Grok expressions do not match field value: [node=cro04 type=SYSCALL msg=audit(1536673014.739:52297): arch=c000003e syscall=264 success=yes exit=0 a0=ffffffffffffff9c a1=c420074040 a2=ffffffffffffff9c a3=c420074060 items=5 ppid=26177 pid=26188 auid=1037893 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=156 comm=\"filebeat\" exe=\"/usr/share/filebeat/bin/filebeat\" key=\"watch-delete-file\"]

```

What is the expected patterns then ? None of the patterns recognized in /var/log/audit/audit.log file

---

<div class="post-metadata">

**Author:** ![pierhugues](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pierhugues/32/48383_2.png) [@pierhugues](https://discuss.elastic.co/u/pierhugues)\
**Post date:** [September 11, 2018, 2:26pm UTC](https://discuss.elastic.co/t/filebeat-auditd-module/148150/2 "2018-09-11T14:26:36Z")

</div>

What version of Filebeat are you running and which OS/version you are running?

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [September 11, 2018, 2:39pm UTC](https://discuss.elastic.co/t/filebeat-auditd-module/148150/3 "2018-09-11T14:39:01Z")

</div>

I think the auditd module [does not expect](https://github.com/elastic/beats/blob/v6.4.0/filebeat/module/auditd/log/ingest/pipeline.json#L8-L9) the leading `node=X`.

It expects to find the logs beginning at `type=`. With auditd you can control the behavior by setting `name_format` in your auditd.conf. The default is `None` IIRC and this causes auditd not to include `node=`.

---

<div class="post-metadata">

**Author:** ![Vijayakumar\_Kannan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vijayakumar_kannan/32/34873_2.png) [@Vijayakumar\_Kannan](https://discuss.elastic.co/u/Vijayakumar_Kannan)\
**Post date:** [September 12, 2018, 4:58am UTC](https://discuss.elastic.co/t/filebeat-auditd-module/148150/4 "2018-09-12T04:58:57Z")

</div>

Thanks andrew. That's worked . Replaced the `name_format=hostname` to `name_format=none` worked.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 10, 2018, 4:59am UTC](https://discuss.elastic.co/t/filebeat-auditd-module/148150/5 "2018-10-10T04:59:02Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.