[Auditbeat] Add ignore errors in audit rules

[fixed77]

In auditd there is a rule "-i".
This rule will cause auditctl to continue loading rules when it runs across an unsupported field or a rule with a syntax error but exit with success reason code.

It would be nice to add this feature to auditbeat.
Thus, it would be possible to make the same auditbeat settings for different systems.

[elasticmachine]

Pinging @elastic/siem (Team:SIEM)

[weastur]

+1

[9r00t-z]

+1

[Dominator-3000]

I really surprised when don't find this function in auditbeat. When you have a large infrastructure with different software that is not unified, it is very difficult to make a single config that is suitable for everything.

[botelastic]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[weastur]

Up

[gwsales]

This is pretty important, how can we get this addressed?

[elasticmachine]

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

[fixed77]

Up

[chenwei791129]

Up, i need this option in auditbeat config

[jkiv]

One possible workaround is to run auditd along side auditbeat.

Use your rules file with auditd and specify socket_type: multicast in the auditd module config in your auditbeat.xml:

# ...
auditbeat.modules:
- module: auditd
  socket_type: multicast
# ...

auditbeat will ignore any audit_rule_files or audit_rule entries and will rely on auditd for audit log messages. (https://discuss.elastic.co/t/auditbeat-running-with-auditd/144782/2)

[jamiehynds]

Thanks to everyone for their upvotes and comments on this Auditbeat enhancement. Happy to report that we've added a new ignore_errors config option via this PR. The option will be available from Auditbeat 8.12 onwards.