# Questions about Auditd Manager

**URL:** <https://discuss.elastic.co/t/questions-about-auditd-manager/368091>\
**Category:** Endpoint Security\
**Created:** [October 1, 2024, 11:53am UTC](https://discuss.elastic.co/t/questions-about-auditd-manager/368091 "2024-10-01T11:53:41Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![KungFuLastic](https://avatars.discourse-cdn.com/v4/letter/k/d78d45/32.png) [@KungFuLastic](https://discuss.elastic.co/u/KungFuLastic)\
**Post date:** [October 1, 2024, 11:53am UTC](https://discuss.elastic.co/t/questions-about-auditd-manager/368091/1 "2024-10-01T11:53:41Z")

</div>

Hi, a question on Auditd Manager Integration after reading the Overview:

1. so it acts similarly to auditd service which reads and saves audit info from the kernel but instead of saving it to disk; it sends it to elastic.
2. thus; auditd service should be disabled or else the two will just write similar data and waste space (one to disk and the other to elastic). worse is the elastic agent is also collecting auditd logs and sending them back to elastic.

so auditd manager is a replacement for auditd for this purpose?

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [October 1, 2024, 2:17pm UTC](https://discuss.elastic.co/t/questions-about-auditd-manager/368091/2 "2024-10-01T14:17:41Z")

</div>

The Audit Manager is effectively the [auditd module](https://www.elastic.co/guide/en/beats/auditbeat/current/auditbeat-module-auditd.html) from Auditbeat.

> so it acts similarly to auditd service which reads and saves audit info from the kernel but instead of saving it to disk; it sends it to elastic.

Yes, it listens to the same kernel audit messages as the auditd daemon. It joins the individual messages that related to the same audit event ID into a single event and does some enrichment (similar to `ausearch --interpret`).

> thus; auditd service should be disabled or else the two will just write similar data and waste space (one to disk and the other to elastic). worse is the elastic agent is also collecting auditd logs and sending them back to elastic.

It can run parallel to the Linux auditd daemon if used in a listen-only manner (i.e. elastic agent does not manage any kernel audit rules). Unless you have some requirement to keep the auditd daemon running and writing to disk, you should be able to use the integration on its own.

---

<div class="post-metadata">

**Author:** ![KungFuLastic](https://avatars.discourse-cdn.com/v4/letter/k/d78d45/32.png) [@KungFuLastic](https://discuss.elastic.co/u/KungFuLastic)\
**Post date:** [October 2, 2024, 5:57am UTC](https://discuss.elastic.co/t/questions-about-auditd-manager/368091/3 "2024-10-02T05:57:29Z")

</div>

Thank you Andrew for your reply. It clarified a lot.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 30, 2024, 5:57am UTC](https://discuss.elastic.co/t/questions-about-auditd-manager/368091/4 "2024-10-30T05:57:38Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.