Closed Aegrah closed 1 month ago
Pinging @elastic/sec-linux-platform (Team:Security-Linux Platform)
@Aegrah, which modules and processors are you expecting for this enhancement? I noticed there's a Filebeat syslog module, syslog processor and a logstash syslog plugin. I'm ruling out the latter. Any thoughts or priorities here?
Btw, I don't see Deb12 listed as a supported OS for agent and filebeat in the support matrix.
Updating the project and team tags based on the ownership details provided below:
https://github.com/elastic/beats/blob/5d44853136c47038c2a75ffd11f7c57982b188fa/.github/CODEOWNERS#L31 https://github.com/elastic/beats/blob/5d44853136c47038c2a75ffd11f7c57982b188fa/.github/CODEOWNERS#L64
Pinging @elastic/sec-deployment-and-devices (Team:Security-Deployment and Devices)
Hi @nick-alayil , I am not at that low level. All started with an Elastic Agent trying to bring audit logs , system logs from Debian 12 and enable elastic security rules
@nick-alayil, Seeing that @Danouchka mentioned the Elastic Agent, that would mean that the customer experienced this issue when using the Agent's syslog processor. But you are correct to state that we indeed do not support Debian 12, I did not know that.
If we do not support Debian 12 in general, and have no plans in supporting it in the future, adding support for rsyslog
does not make much sense, as we are currently only experiencing this issue with the Debian 12 rsyslog
implementation. I will let the next assignee from Security-Deployment and Devices
decide on whether we close this out, or go for an implementation.
Thank you!
My recommendation is to close this ticket and raise an enhancement request to add Debian 12 support for the Elastic Agent. Once this support is added, the issue should ideally be resolved. Additionally, I am unsure if this use case is part of the test case that qualifies agent support on an OS. Therefore, I recommend mentioning this ticket in the ER.
I will close out this issue, as it can now be tracked from https://github.com/elastic/enhancements/issues/22255.
Issue
From Debian 12 and up, Debian switched to
journalctl
and no longer ships with defaultsyslog
. The go-to syslog implementation for Debian is thersyslog
package, downloadable from the APT repositories. This implementation of syslog has different mappings than the "default" syslog on earlier versions of Debian. Thus, it doesn't have several essential ECS fields, making several Linux detection rules no longer function.rsyslog: https://www.rsyslog.com/
Examples
Several unusual fields include:
system.auth.useradd.home
system.auth.useradd.shell
Additionally, the parsed logs no longer contain an
event.category
.Request
This issue will likely exist for Debian 13 when it gets released as well. We might want to consider parsing these in a way that allows us to stay consistent with ECS and other syslog versions.
Example full log: