openstack/openstack-ansible-ops
Code Issues Proposed changes

Add login and package monitoring to auditbeat

Browse Source 
The auditbeat deployment currently misses two system data sets that
it supports: login and package. The login dataset collects user login,
logout and system boot data, whereas the package dataset monitors the
installed packages on the system. This commit enables both datasets,
so Auditbeat now collects the maximum amount of system data.

Change-Id: Ib071db1f179cee7148cd54ee945f89f9e226fe16
This commit is contained in:
Duncan Martin Walker
2020-05-04 14:13:09 +01:00
parent bfe38b3a21
commit 3606af8175
1 changed files with 2 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
elk_metrics_7x/roles/elastic_auditbeat/templates/auditbeat.yml.j2
View File

@@ -137,6 +137,8 @@ auditbeat.modules:
- module: system
datasets:
- host # General host information, e.g. uptime, IPs
- login # User logins, logouts, and system boots.
- package # Installed, updated, and removed packages
- process # Started and stopped processes
- socket # Opened and closed sockets
- user # User information