I am using Pivotal Kubernetes clusters on vmware and collecting logs on Splunk. I installed auditbeat and tried to exclude hostfs/etc/sv/monit/.kube/ path but never managed to discard it at file_integrity module. I tried different regex but somehow auditbeat still sending logs related with this directory.
Ant tips will be appreciated.
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.