From 557ef6d94888ea3626dc7553b5ebc7f334f1d543 Mon Sep 17 00:00:00 2001 From: Andrew Kroh Date: Mon, 10 Jul 2017 00:52:11 -0400 Subject: [PATCH 1/3] Auditbeat file module improvements Unify the behavior across operating systems. - Add tests. - Resolve UID/GID/SID into owner/group. - Log warning if a file watch cannot be added. Previously it would fail at startup. - Remove usage of fsevents on macOS and use kqueues instead. The data provided was inconsistent with the fsnotify. It was valuable data but the signal needs some refinement to make it consistent. The biggest issue is that multiple events are coalesced into one. Another issue is that the watches are recursive (this is great, but it's inconsistent) and we will need to allow a glob to be specified then match the incoming events against the glob (future enhancement). - Document hash fields - Initialize watches on Start() rather than at construction time. - Update data.json to include file owner and group names. - Add file type and symlink target path to the events. - Filter fsnotify events with empty paths (saw this once on Windows). --- Vagrantfile | 21 ++ auditbeat/docs/fields.asciidoc | 44 ++- auditbeat/module/audit/file/_meta/data.json | 15 +- auditbeat/module/audit/file/_meta/fields.yml | 22 +- auditbeat/module/audit/file/event.go | 109 +++++--- .../module/audit/file/eventreader_darwin.go | 86 ------ .../module/audit/file/eventreader_fsnotify.go | 119 ++++++++ .../module/audit/file/eventreader_other.go | 83 ------ auditbeat/module/audit/file/fileinfo_bsd.go | 65 +++-- auditbeat/module/audit/file/fileinfo_linux.go | 65 +++-- .../module/audit/file/fileinfo_windows.go | 87 ++++-- auditbeat/module/audit/file/metricset.go | 13 +- auditbeat/module/audit/file/metricset_test.go | 259 ++++++++++++++++++ .../module/audit/file/security_windows.go | 56 ++++ .../audit/file/security_windows_test.go | 40 +++ .../module/audit/file/zsecurity_windows.go | 30 ++ 16 files changed, 824 insertions(+), 290 deletions(-) delete mode 100644 auditbeat/module/audit/file/eventreader_darwin.go create mode 100644 auditbeat/module/audit/file/eventreader_fsnotify.go delete mode 100644 auditbeat/module/audit/file/eventreader_other.go create mode 100644 auditbeat/module/audit/file/security_windows.go create mode 100644 auditbeat/module/audit/file/security_windows_test.go create mode 100644 auditbeat/module/audit/file/zsecurity_windows.go diff --git a/Vagrantfile b/Vagrantfile index 47857ef61c0..86da498e6c0 100644 --- a/Vagrantfile +++ b/Vagrantfile @@ -55,6 +55,15 @@ cd ~/go/src/github.com/elastic if [ -d "/vagrant" ]; then ln -s /vagrant beats; fi SCRIPT +# Linux GVM +$linuxGvmProvision = <