Is it possible to run Auditbeat on Ubuntu on Power (ppc64le) hardware?

Elastic Stack Beats
1

Question pretty much says it. Having to migrate to a beast of a machine with Ubuntu and a Power architecture.

https://www.elastic.co/downloads/beats/auditbeat

,deb is the wrong architecture, but not sure what the Linux architecture is.

Or is this something that we would have to take the source for an build it?

(or will it not work at all?)

Thanks in advance. N

2

We don't test on PPC, but we do have development snapshots that you could test out. If it works then I'd recommend building the release yourself from a git tag (you don't really want to deploy a snapshot build into prod).

3

Hi Andrew. Thanks as always! Will give it a go tomorrow. N

4

Hi Andrew, not sure if this is a hiccup

 nhopper@ptcdeskfs:~/Downloads$ sudo apt install ./auditbeat-6.6.0-SNAPSHOT-ppc64el.deb
Reading package lists... Done
Building dependency tree       
Reading state information... Done
Note, selecting 'auditbeat' instead of './auditbeat-6.6.0-SNAPSHOT-ppc64el.deb'
The following NEW packages will be installed
  auditbeat
0 to upgrade, 1 to newly install, 0 to remove and 0 not to upgrade.
Need to get 0 B/10.2 MB of archives.
After this operation, 34.5 MB of additional disk space will be used.
Get:1 /home/nhopper/Downloads/auditbeat-6.6.0-SNAPSHOT-ppc64el.deb auditbeat ppc64el 6.6.0 [10.2 MB]
Selecting previously unselected package auditbeat.
(Reading database ... 178442 files and directories currently installed.)
Preparing to unpack .../auditbeat-6.6.0-SNAPSHOT-ppc64el.deb ...
Unpacking auditbeat (6.6.0) ...
Setting up auditbeat (6.6.0) ...
Processing triggers for ureadahead (0.100.0-20) ...
Processing triggers for systemd (237-3ubuntu10.6) ...
N: Download is performed unsandboxed as root, as file '/home/nhopper/Downloads/auditbeat-6.6.0-SNAPSHOT-ppc64el.deb' couldn't be accessed by user '_apt'. - pkgAcquire::Run (13: Permission denied)
5

Hi, While it says it installed, it fails to run so we are going to try and build it on there from the source and keep our fingers crossed. Cheers, N.

6

Simple fix to the snapshot, just permissions on the auditbeat.yml

7

What was the issue? The deb package installed the file with the wrong permissions? What were the permissions?

The build process for packaging should be asserting the the permissions on the /etc/auditbeat/auditbeat.yml are 0600 with root ownership.

8

Hi Andrew, should have said that was my fault, but not 100% sure why. Installed Auditbeat and copied across the auditbeat.yml file from another system before starting it. My guess is that the route it took must have messed up permissions. Once fixed, it ran fine. Cheers, N.

9

This topic was automatically closed 21 days after the last reply. New replies are no longer allowed.