Graylog2 / Graylog2/graylog2-server

Sidecar auditbeat default config fails on ARM (Ubuntu 24.10)

Open
#21,118 1 comment 1 reaction 0 assignees View on GitHub
bug triaged
Dominant language
Java
Stars
8.1k
Forks
1.1k
Avg merge
1d 20h
Merged PRs (30d)
217

Description

I tested the default sidecar auditbeat configuration (_auditbeat-linux-default_) on [Ubuntu 24.10 64-bit ARM (ARMv8/AArch64) desktop image](https://cdimage.ubuntu.com/releases/oracular/release/) and found that it fails with this error message in the auditbeat log:

`Exiting: 1 error: failed to unpack the auditd config: 1 error: failed loading rules: 2 errors: at (audit_rules at auditbeat.yml):25: failed to interpret rule '-a always,exit -F arch=b64 -S open,creat,truncate,ftruncate,openat,open_by_handle_at -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -F key=access': failed to add syscall 'open': unknown syscall 'open' for arch aarch64; at (audit_rules at auditbeat.yml):26: failed to interpret rule '-a always,exit -F arch=b64 -S open,creat,truncate,ftruncate,openat,open_by_handle_at -F exit=-EPERM -F auid>=1000 -F auid!=4294967295 -F key=access': failed to add syscall 'open': unknown syscall 'open' for arch aarch64 accessing 'auditbeat.modules.0' (source:'/var/lib/graylog-sidecar/generated/674f3395440f6d6ae5bcab35/auditbeat.conf')`

Looks like this part of the config causing the error:

`-a always,exit -F arch=b64 -S open,creat,truncate,ftruncate,openat,open_by_handle_at -F exit=-EACCES -F auid>=1000 -F auid!=4294967295 -F key=access`

## Your Environment

* Graylog Version: Graylog 6.2.0-SNAPSHOT

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.