# Why don't sudo events from auth.log have an event.category/event.action?

**URL:** <https://discuss.elastic.co/t/why-dont-sudo-events-from-auth-log-have-an-event-category-event-action/193911>\
**Category:** SIEM\
**Created:** [August 6, 2019, 3:13am UTC](https://discuss.elastic.co/t/why-dont-sudo-events-from-auth-log-have-an-event-category-event-action/193911 "2019-08-06T03:13:20Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![agx](https://avatars.discourse-cdn.com/v4/letter/a/e19adc/32.png) [@agx](https://discuss.elastic.co/u/agx)\
**Post date:** [August 6, 2019, 3:13am UTC](https://discuss.elastic.co/t/why-dont-sudo-events-from-auth-log-have-an-event-category-event-action/193911/1 "2019-08-06T03:13:20Z")

</div>

Hello,

I've been exploring the new SIEM features in 7.3 and am pretty excited about promoting ECS at work.

I noticed that when ingesting my auth logs from Ubuntu 18.04 using the system module included with filebeat, that sudo entries from the auth.log just show up blank in the timeline explorer.

Was this a design decision? Shouldn't a sudo event have event fields populated too?

 ![elastic_siem](https://us1.discourse-cdn.com/elastic/original/3X/2/0/20a1243f6d84dce602a181bcef423c4553a10e29.png)

---

<div class="post-metadata">

**Author:** ![tudor](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tudor/32/3753_2.png) [@tudor](https://discuss.elastic.co/u/tudor)\
**Post date:** [August 7, 2019, 11:10am UTC](https://discuss.elastic.co/t/why-dont-sudo-events-from-auth-log-have-an-event-category-event-action/193911/2 "2019-08-07T11:10:21Z")

</div>

It's not a design decision, it's more of something that's not complete yet. We're still in the process of defining those fields and will work on improving the Beats modules to consistently fill them. This is a pretty long process, though.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 4, 2019, 11:14am UTC](https://discuss.elastic.co/t/why-dont-sudo-events-from-auth-log-have-an-event-category-event-action/193911/3 "2019-09-04T11:14:08Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.