elastic / elastic/integrations
[Auditd Manager]: Wrong log content with session tracing feature on
- Dominant language
- Handlebars
- Stars
- 333
- Forks
- 647
- Avg merge
- 3d 4h
- Merged PRs (30d)
- 209
Description
### Integration Name
Auditd Manager [auditd_manager]
### Dataset Name
_No response_
### Integration Version
1.19.0
### Agent Version
8.18.5
### Agent Output Type
elasticsearch
### Elasticsearch Version
8.18.5
### OS Version and Architecture
ubuntu 24.04.03 LTS
### Software/API Version
_No response_
### Error Message
_No response_
### Event Original
[type=SYSCALL msg=audit(1758885372.736:43290108): arch=c000003e syscall=59 success=yes exit=0 a0=61db43358790 a1=61db43204a40 a2=61db433398a0 a3=61db43204a40 items=2 ppid=2830 pid=32736 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=pts0 ses=3 comm="mkdir" exe="/usr/bin/mkdir" subj=unconfined key="exec", type=EXECVE msg=audit(1758885372.736:43290108): argc=2 a0="mkdir" a1="aal", type=PATH msg=audit(1758885372.736:43290108): item=0 name="/usr/bin/mkdir" inode=1198344 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0, type=PATH msg=audit(1758885372.736:43290108): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=1201555 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0, type=PROCTITLE msg=audit(1758885372.736:43290108): proctitle=6D6B6469720061616C]
### What did you do?
I configured it with my auditd rules and turned on/off session tracking feature from GUI.
### What did you see?
I saw wrong process.name, process.executable for process execution events when session tracing is turned on. raw log content was ok and it looked like auditd manager was supposed to pull data from auditd events appropriately.After turning before mentioned feature off log fields were matching original logs and other fields such as process.args or process.title.
### What did you expect to see?
I expected process.executable and process.name to match the process that is executed, the way it is logged in auditd events and parsed in other fields such as process.args.
### Anything else?
_No response_
Contributor guide
Assessment
This issue has not been assessed yet.