# Filebeat for auditd events

**URL:** <https://discuss.elastic.co/t/filebeat-for-auditd-events/108410>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [November 20, 2017, 3:02pm UTC](https://discuss.elastic.co/t/filebeat-for-auditd-events/108410 "2017-11-20T15:02:51Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![bm\_rec](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bm_rec/32/24470_2.png) [@bm\_rec](https://discuss.elastic.co/u/bm_rec)\
**Post date:** [November 20, 2017, 3:02pm UTC](https://discuss.elastic.co/t/filebeat-for-auditd-events/108410/1 "2017-11-20T15:02:51Z")

</div>

Hello! Could you help me with my issue?  
I need to get security events from auditd. I've updated filebeat from 5.3.2 to 5.6.4 to 6.0.0. Filebeat worked via audisp-simplify. I want to exclude audisp-simplify from the system because Filebeat 6 can work on with auditd log directly.  
And now I can't setting up Filebeat. My **filebeat.yml** :  
atlassian-test:~ # grep -nvE '(#|^$)' /etc/filebeat/filebeat.yml  
12:filebeat.modules:  
29:auth:  
30: enabled: true  
71:log:  
72: enabled: true  
76: var.paths: /var/log/audit/audit.log  
449:filebeat.config:  
450: prospectors:  
455: modules:  
456: enabled: true  
457: path: modules.d/\*.yml  
458: reload.enabled: true  
459: reload.period: 10s  
471:tags: ["linux\_ib"]  
680:output.logstash:  
682: enabled: true  
684: hosts: ["172.29.39.13:5044"]  
1096:setup.template.settings:  
1114:setup.kibana:  
1171:logging.level: debug  
1192:logging.to\_files: true  
1193:logging.files:  
Config is OK, I don't get auditd logs to ElasticSearch and log is here:  
[https://pastebin.com/24ZKf9Zu](https://pastebin.com/24ZKf9Zu).  
If I uncomment string 70 **- module: auditd** , I've got an error:  
atlassian-test:~ # filebeat test config  
filebeat2017/11/20 14:48:22.319598 beat.go:625: CRIT Exiting: error loading config file: yaml: line 69: did not find expected key  
Exiting: error loading config file: yaml: line 69: did not find expected key  
Should I use a log prospector? Also I need filtering some useless string. Look at my old config:  
atlassian-test:~ # grep -nvE '(#|^$)' /etc/filebeat/filebeat.yml2  
12:filebeat.prospectors:  
18:- input\_type: log  
21: paths:  
22: - /var/log/audit/audit.log  
24: tags: ["linux\_ib"]  
25: document\_type: linuxlogs  
26: include\_lines: ['terminal', 'identify']  
27: exclude\_lines: ['cron', 'systemd', 'git', 'java']  
28: close\_removed: true  
29: clean\_removed: true  
96:output.logstash:  
98: hosts: ["172.29.39.13:5044"]  
Any suggestions? I don't have auth.log and secure in SLES 12 (why?).

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [November 20, 2017, 4:15pm UTC](https://discuss.elastic.co/t/filebeat-for-auditd-events/108410/2 "2017-11-20T16:15:32Z")

</div>

Have you considered [Auditbeat](https://www.elastic.co/products/beats/auditbeat)? It's currently a beta release.

Docs for the module that collectes audit data: [https://www.elastic.co/guide/en/beats/auditbeat/current/auditbeat-metricset-audit-kernel.html](https://www.elastic.co/guide/en/beats/auditbeat/current/auditbeat-metricset-audit-kernel.html)

In comparison to the Filebeat module it's going to be more comprehensive in what it parses because it combines related messages (based on their sequence num) into a single event. It also enriches the events by doing uid/gid conversion.

---

<div class="post-metadata">

**Author:** ![bm\_rec](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bm_rec/32/24470_2.png) [@bm\_rec](https://discuss.elastic.co/u/bm_rec)\
**Post date:** [November 21, 2017, 7:00am UTC](https://discuss.elastic.co/t/filebeat-for-auditd-events/108410/3 "2017-11-21T07:00:13Z")

</div>

Hmm... Beta is not good idea, because I implement it in production for my client.

---

<div class="post-metadata">

**Author:** ![bm\_rec](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bm_rec/32/24470_2.png) [@bm\_rec](https://discuss.elastic.co/u/bm_rec)\
**Post date:** [November 24, 2017, 2:10pm UTC](https://discuss.elastic.co/t/filebeat-for-auditd-events/108410/4 "2017-11-24T14:10:20Z")

</div>

So, how can I monitor auditd via filebeat? If I run enable command I get an error:

```
# filebeat modules enable auditd
Module auditd doesn't exists!
# filebeat modules list
Enabled:
Disabled:`

```

Anyway audit logs appear in ELK but not parsed (its have additional tag beats\_input\_codec\_plain\_applied).  
And I want to add a prospector for exclude some lines for example.  
My config file filebeat.yml now:

```
  filebeat.modules:
  - module: auditd
    log.enabled: true
  # filebeat.prospector:
 #- type: log
 # enabled: true
 # include_lines: ['terminal', 'identify']
 # exclude_lines: ['cron', 'systemd', 'git', 'java']
 # paths:
 # - /var/log/audit/audit.log
 # scan_frequency: 5s
 filebeat.config:
   prospectors:
      #enabled: false
      #path: prospectors.d/*.yml
      #reload.enabled: true
      #reload.period: 10s
    modules:
      enabled: true
      path: modules.d/*.yml
      reload.enabled: true
      reload.period: 10s
  tags: ["linux_ib"]
  output.logstash:
    enabled: true
    hosts: ["172.29.39.13:5044"]
    ttl: 90s
  setup.template.settings:
  setup.kibana:
  logging.level: debug
  logging.to_files: true
  logging.files:
```

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [November 28, 2017, 10:59am UTC](https://discuss.elastic.co/t/filebeat-for-auditd-events/108410/5 "2017-11-28T10:59:39Z")

</div>

All of the Filebeat modules have a dependency on Elasticsearch ingest node so they [only work properly](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-modules-overview.html) when Filebeat outputs directly to Elasticsearch.

> [@bm\_rec](#):
>
> Anyway audit logs appear in ELK but not parsed (its have additional tag beats\_input\_codec\_plain\_applied).
> 
> And I want to add a prospector for exclude some lines for example.

I believe any of the regular [prospector options](https://www.elastic.co/guide/en/beats/filebeat/6.0/configuration-filebeat-options.html) can be configured for module by putting the option under `var` (e.g. `auditd.log.var.<option_name>`).

```auto
filebeat.modules:
- module: auditd
  log:
    enabled: true
    var:
      include_lines: ['terminal', 'identify']
      exclude_lines: ['cron', 'systemd', 'git', 'java']

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 26, 2017, 10:59am UTC](https://discuss.elastic.co/t/filebeat-for-auditd-events/108410/6 "2017-12-26T10:59:43Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.