Beats: [Auditbeat] Allow flushing of auditd rules

[kholia]

Auditbeat doesn't flush auditd rules upon daemon exit. This leads to /var/log/kern.log getting flooded with all the audit messages.

Furthermore, it seems that auditbeat doesn't have a CLI option to flush the auditd rules.

It seems that auditd too doesn't flush rules on daemon exit.

# systemctl start auditd

# auditctl -l
No rules

# auditctl -a always,exit -F arch=b64 -S adjtimex -S settimeofday -k time_change
# auditctl -l
-a always,exit -F arch=b64 -S adjtimex,settimeofday -F key=time_change

# systemctl stop auditd

# auditctl -l
-a always,exit -F arch=b64 -S adjtimex,settimeofday -F key=time_change

If flushing rules on daemon exit is not appropriate, then the auditbeat CLI shoould at least provide a way to flush the rules manually.

Details,

• Version: Auditbeat 6.4.0
• Operating System: Ubuntu 16.04 LTS / 18.04 LTS

[kholia]

Minimal configuration file,

#==========================  Modules configuration =============================
auditbeat.modules:

- module: auditd
  # Load audit rules from separate files. Same format as audit.rules(7).
  # audit_rule_files: [ '${path.config}/audit.rules.d/*.conf' ]
  audit_rules: |
    ## Executions.
    -a always,exit -F arch=b64 -S execve,execveat -k exec

#==================== Elasticsearch template setting ==========================
setup.template.settings:
  index.number_of_shards: 3
  #index.codec: best_compression
  #_source.enabled: false

#-------------------------- Elasticsearch output ------------------------------
output.elasticsearch:
  # Array of hosts to connect to.
  hosts: ["localhost:9200"]

1. Start auditbeat with this configuration.

2. Stop auditbeat.

3. Run sudo ./auditbeat show auditd-rules, which shows

   -a never,exit -S all -F pid=31859
   -a always,exit -F arch=b64 -S execve,execveat -F key=exec
   

[urso]

@andrewkroh any idea?

[elasticmachine]

Pinging @elastic/siem (Team:SIEM)

[andrewkroh]

I think this would be a good option to add to Auditbeat. And also add a subcommand to clear the rules (#11825).

[rbabyuk-vs]

we faced this problem as well, this caused huge problems. I vote for mechanism to flush rules by using AB itself.