You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
During troubleshooting in a Wazuh deployment using this Puppet module, I observed that systems with audit version 3.1.2 were defaulting to realtime monitoring due to the absence of audispd-plugins. Manual installation and configuration of the plugin resolved the issue, underscoring the need for its inclusion in the module. Since the audispd-plugins was missing also the audit rules for monitoring were missing as well:
2024/01/11 19:18:15 wazuh-syscheckd: WARNING: (6913): Who-data engine could not start. Switching who-data to real-time.
Check of the audit FIM rules
auditctl -l | grep wazuh_fim
Summary
The current Wazuh Puppet module (audit.pp manifest) effectively manages the installation and configuration of auditd across various Linux distributions. However, it lacks support for installing the audispd-plugins package, which is crucial for the optimal functioning of whodata monitoring in Wazuh, especially with audit versions 3.1.1 and later according to the Wazuh docs
Details
The current audit.pp manifest in the Wazuh Puppet module includes provisions for:
Installing the auditd package
Managing the auditd service
Configuring audit rules if $audit_manage_rules is set to true
However, there is no reference to or provision for the installation of audispd-plugins.
Suggested Enhancement
I propose adding functionality to the audit.pp manifest for the Wazuh Puppet module to handle the installation and configuration of the audispd-plugins package. This enhancement would ensure that environments requiring whodata monitoring with audit version 3.1.1 or later are fully supported and configured correctly through Puppet automation.
I created a pull request that incorporates the above changes.
The text was updated successfully, but these errors were encountered:
Issue Description
During troubleshooting in a Wazuh deployment using this Puppet module, I observed that systems with audit version 3.1.2 were defaulting to
realtime
monitoring due to the absence ofaudispd-plugins
. Manual installation and configuration of the plugin resolved the issue, underscoring the need for its inclusion in the module. Since theaudispd-plugins
was missing also the audit rules for monitoring were missing as well:Audit package version check
OSSEC LOGS:
Check of the audit FIM rules
Summary
The current Wazuh Puppet module (audit.pp manifest) effectively manages the installation and configuration of
auditd
across various Linux distributions. However, it lacks support for installing theaudispd-plugins
package, which is crucial for the optimal functioning ofwhodata
monitoring in Wazuh, especially with audit versions 3.1.1 and later according to the Wazuh docsDetails
The current
audit.pp
manifest in the Wazuh Puppet module includes provisions for:However, there is no reference to or provision for the installation of
audispd-plugins
.Suggested Enhancement
I propose adding functionality to the
audit.pp
manifest for the Wazuh Puppet module to handle the installation and configuration of theaudispd-plugins
package. This enhancement would ensure that environments requiringwhodata
monitoring with audit version 3.1.1 or later are fully supported and configured correctly through Puppet automation.I created a pull request that incorporates the above changes.
The text was updated successfully, but these errors were encountered: