Do we need to install and start auditd in order to user AuditBeat? Or just installation AuditBeat will do the auditing , logging without auditd daemon? On last question is there any functşon that auditd can do but, AuditBeat can't do?
regards
1 Like
The following page is a good description of the description between auditd and auditbeat.
Auditbeat communicates directly with the Linux audit framework, collects the same data as auditd, and sends the events to the Elastic Stack in real time. If you’re feeling nostalgic, you can run auditd alongside Auditbeat (in newer kernels).
This topic was automatically closed 21 days after the last reply. New replies are no longer allowed.