I'm tracking the rmdir syscall with the following rule:
audit_rules: |
-a always,exit -F dir=/sasdata -F arch=b64 -S creat -S open -S openat -S unlink -S unlinkat -S symlink -S symlinkat -S link -S linkat -S rename -S renameat -S chmod -S fchmod -S fchmodat -S chown -S fchown -S fchownat -S mkdir -S mkdirat -S rmdir -S setxattr -S lsetxattr -S fsetxattr -S removexattr -S lremovexattr -S fremovexattr -k filesystem_op
I get the following event when I remove a directory in the watched directory:
{"auditd":{"data":{"a0":"7ffcda1b1756","a1":"2","a2":"7f398c8c0280","a3":"7ffcda1b0a60","arch":"x86_64","exit":"0","syscall":"rmdir","tty":"pts0"},"message_type":"syscall","paths":[{"cap_fe":"0","cap_fi":"0000000000000000","cap_fp":"0000000000000000","cap_fver":"0","dev":"08:04","inode":"100916940","item":"0","mode":"040775","name":"/sasdata/","objtype":"PARENT","ogid":"201327708","ouid":"0","rdev":"00:00"},{"cap_fe":"0","cap_fi":"0000000000000000","cap_fp":"0000000000000000","cap_fver":"0","dev":"08:04","inode":"100916940","item":"1","mode":"040775","objtype":"PARENT","ogid":"201327708","ouid":"0","rdev":"00:00"},{"cap_fe":"0","cap_fi":"0000000000000000","cap_fp":"0000000000000000","cap_fver":"0","dev":"08:04","inode":"33731764","item":"2","mode":"040755","objtype":"DELETE","ogid":"0","ouid":"0","rdev":"00:00"}],"result":"success","sequence":22040,"session":"2092","summary":{"actor":{"primary":"aevangelista","secondary":"root"},"how":"/usr/bin/rmdir","object":{"primary":"/sasdata/","type":"file"}}},"event":{"action":"deleted","category":["file"],"kind":"event","module":"auditd","outcome":"success","type":["deletion"]},"file":{"device":"00:00","gid":"201327708","group":"sasusers","inode":"100916940","mode":"0775","owner":"root","path":"/sasdata/","uid":"0"},"process":{"executable":"/usr/bin/rmdir","name":"rmdir","pid":11064,"ppid":10616,"title":"rmdir /sasdata/testdir/","working_directory":"/home/aevangelista"},"service":{"type":"auditd"},"tags":["filesystem_op"],"user":{"audit":{"id":"201327714","name":"aevangelista"},"filesystem":{"group":{"id":"0","name":"root"},"id":"0","name":"root"},"group":{"id":"0","name":"root"},"id":"0","name":"root","saved":{"group":{"id":"0","name":"root"},"id":"0","name":"root"}}}
I expected to see the deleted file path in the PATH record with objtype=DELETE, but it's not there nor anywhere else in the event.
If I stop auditbeat, set up the same audit rule on auditd conf file, start the auditd service and remove the same directory once again, I can see the deleted file path in the PATH record with objtype=DELETE:
type=SYSCALL msg=audit(1614718358.207:22068): arch=c000003e syscall=84 success=yes exit=0 a0=7ffcc2324757 a1=2 a2=7f7e689e7280 a3=7ffcc23228e0 items=2 ppid=11070 pid=22265 auid=201327714 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=2093 comm="rmdir" exe="/usr/bin/rmdir" key="filesystem_op"
type=CWD msg=audit(1614718358.207:22068): cwd="/home/aevangelista"
type=PATH msg=audit(1614718358.207:22068): item=0 name="/sasdata/" inode=100916940 dev=08:04 mode=040775 ouid=0 ogid=201327708 rdev=00:00 objtype=PARENT cap_fp=0000000000000000 cap_fi=0000000000000000 cap_fe=0 cap_fver=0
type=PATH msg=audit(1614718358.207:22068): item=1 name="/sasdata/testdir" inode=68153511 dev=08:04 mode=040755 ouid=0 ogid=0 rdev=00:00 objtype=DELETE cap_fp=0000000000000000 cap_fi=0000000000000000 cap_fe=0 cap_fver=0
Oddly, there are 2 PATH records in the auditd event and 3 in the Auditbeat event. Shouldn't a syscall event recorded by Auditbeat have the same number of PATH records of a syscall event recorded by auditd?
Is this an Auditbeat bug or am I doing something wrong here?