search

elastic / beats

:tropical_fish: Beats - Lightweight shippers for Elasticsearch & Logstash
https://www.elastic.co/products/beats
Other
12.14k stars 4.91k forks source link

[ldap] LDAP query fails to fetch user/group data with lots of results #40482

Closed nicpenning closed 2 weeks ago

nicpenning commented 1 month ago

Using the 0.0.1 Entity Analytics Active Directory integration on 8.15.0, I have not been able to ingest user/group data.

In the event logs I see the following error log:

message : Error running full sync
log.origin.file.name : activedirectory/activedirectory.go
log.origin.function : github.com/elastic/beats/v7/x-pack/filebeat/input/entityanalytics/provider/activedirectory.(*adInput).Run
error.message : failed to get group details: LDAP Result Code 4 "Size Limit Exceeded": 
failed to get user details: LDAP Result Code 4 "Size Limit Exceeded":

For confirmed bugs, please report:

elasticmachine commented 1 month ago

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

nicpenning commented 1 month ago

With the paging, I still get an OOM error and it crashes with no results. I will post more details later. I tried paging at 256 and 1000 with the same behavior. Stay tuned.

nicpenning commented 2 weeks ago

Still did not succeed when running on Windows.

However, using the paging in 0.2.0 on a Linux OS, I successfully pulled in data. Trouble now is it seems to be doing a full sync every 15 minutes. I suppose that is a different issue, though.

So currently Linux works (to a degree) but Windows does not. Doing some offline conversations, this may be due to how command prompt handles the results but I will that to @efd6 to convey.

nicpenning commented 2 weeks ago

Excited to test this as it becomes available.