Skip to content

Conversation

@andrewkroh
Copy link
Member

@andrewkroh andrewkroh commented Sep 13, 2023

auditd is not a generic input type that you would be applying to different sources. It specifically reads the output of the Linux auditd daemon. It does not need to be able to write to arbitrary logs-* data streams.

Relates: #6808 (comment)

Checklist

  • I have reviewed tips for building integrations and this pull request is aligned with them.
  • I have verified that all data streams collect metrics or logs.
  • I have added an entry to my package's changelog.yml file.
  • I have verified that Kibana version constraints are current according to guidelines.

Related issues

@elasticmachine
Copy link

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

@elasticmachine
Copy link

elasticmachine commented Sep 13, 2023

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS
Pipeline View Test View Changes Artifacts preview preview

Expand to view the summary

Build stats

  • Start Time: 2023-09-19T20:15:00.259+0000

  • Duration: 15 min 20 sec

Test stats 🧪

Test Results
Failed 0
Passed 9
Skipped 0
Total 9

🤖 GitHub comments

Expand to view the GitHub comments

To re-run your PR in the CI, just comment with:

  • /test : Re-trigger the build.

@elasticmachine
Copy link

elasticmachine commented Sep 13, 2023

🌐 Coverage report

Name Metrics % (covered/total) Diff
Packages 100.0% (1/1) 💚
Files 100.0% (1/1) 💚 5.772
Classes 100.0% (1/1) 💚 5.772
Methods 100.0% (15/15) 💚 8.591
Lines 97.985% (2140/2184) 👍 10.936
Conditionals 100.0% (0/0) 💚

auditd is not a generic input type that you would be applying to different sources.
It specifically reads the output of the Linux auditd daemon. It does not need to be able
to write to arbitrary logs-* data streams.

Relates: #6808 (comment)
Copy link
Contributor

@efd6 efd6 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

On the basis of the PR description, this LGTM, but the logic behind the addition and the subsequent related closed PR is a little muddy.

@andrewkroh andrewkroh merged commit 7fdf53e into elastic:main Sep 20, 2023
@elasticmachine
Copy link

Package auditd - 3.13.1 containing this change is available at https://epr.elastic.co/search?package=auditd

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants