Auditd module

edit

This module collects and parses logs from the audit daemon (auditd).

Compatibility

edit

This module was tested with logs from auditd on OSes like CentOS 6 and CentOS 7.

This module is not available for Windows.

Dashboard

edit

This module comes with a sample dashboard showing an overview of the audit log data. You can build more specific dashboards that are tailored to the audit rules that you use on your systems.

kibana audit auditd

Syslog fileset settings

edit

var.paths

edit

An array of paths where to look for the log files. If left empty, Filebeat will choose the paths depending on your operating systems.

Fields

edit

For a description of each field in the metricset, see the exported fields section.