|
| 1 | +## Overview |
| 2 | + |
| 3 | +[Linux Audit Logs][3] record detailed information about system events, user activities, and security-related actions. They are essential for monitoring system integrity, detecting unauthorized access, and ensuring compliance with security policies and regulations. |
| 4 | + |
| 5 | +This integration provides enrichment and visualization for various log types, including: |
| 6 | +- **Mandatory Access Control (MAC)** configurations and status |
| 7 | +- **MAC policies** |
| 8 | +- **Role** assignments, removals, and user role changes |
| 9 | +- **Audit** configuration changes and audit daemon events (such as aborts, configuration changes) |
| 10 | +- **User authentication** events |
| 11 | +- **User account** credential modifications |
| 12 | +- **User and group** management activities |
| 13 | +- **SELinux user** errors |
| 14 | +- **Access Vector Cache (AVC)** logs |
| 15 | + |
| 16 | +It supports these logs across **Red Hat**, **Ubuntu**, and **CentOS** Linux operating systems. |
| 17 | + |
| 18 | +This integration collects Linux audit logs and sends them to Datadog for analysis. It provides visual insights through out-of-the-box dashboards and the Log Explorer, and helps monitor and respond to security threats using ready-to-use Cloud SIEM detection rules. |
| 19 | + |
| 20 | +* [Log Explorer][4] |
| 21 | +* [Cloud SIEM][5] |
| 22 | + |
| 23 | +## Setup |
| 24 | + |
| 25 | +### Installation |
| 26 | + |
| 27 | +To install the Linux Audit Logs integration, run the following Agent installation command. For more information, see [Integration Management][6]. |
| 28 | + |
| 29 | +**Note**: This step is not necessary for Agent versions >= 7.66.0 |
| 30 | + |
| 31 | +For Linux, run: |
| 32 | + ```shell |
| 33 | + sudo -u dd-agent -- datadog-agent integration install datadog-linux-audit-logs==1.0.0 |
| 34 | + ``` |
| 35 | + |
| 36 | +### Configuration |
| 37 | + |
| 38 | +#### Install the Audit Daemon (`auditd`) |
| 39 | + |
| 40 | +1. Install `auditd` on Linux: |
| 41 | + - **Debian/Ubuntu:** |
| 42 | + |
| 43 | + ```shell |
| 44 | + sudo apt-get update |
| 45 | + sudo apt-get install auditd |
| 46 | + ``` |
| 47 | + |
| 48 | + - **CentOS/RHEL:** |
| 49 | + |
| 50 | + ```shell |
| 51 | + sudo yum install audit |
| 52 | + ``` |
| 53 | + |
| 54 | +2. Start the Audit Daemon: |
| 55 | + |
| 56 | + ```shell |
| 57 | + sudo systemctl start auditd |
| 58 | + ``` |
| 59 | + |
| 60 | +3. Enable the Audit Daemon to Start on Boot: |
| 61 | + ```shell |
| 62 | + sudo systemctl enable auditd |
| 63 | + ``` |
| 64 | + |
| 65 | +4. Verify the Status of the Audit Daemon: |
| 66 | + ```shell |
| 67 | + sudo systemctl status auditd |
| 68 | + ``` |
| 69 | + |
| 70 | +#### Configure the Audit Daemon (`auditd`) |
| 71 | + |
| 72 | +1. Give the `dd-agent` user read permission for rotated audit log files: |
| 73 | + ```shell |
| 74 | + sudo grep -q "^log_group=" /etc/audit/auditd.conf && sudo sed -i 's/^log_group=.*/log_group=dd-agent/' /etc/audit/auditd.conf || echo "log_group=dd-agent" | sudo tee -a /etc/audit/auditd.conf |
| 75 | + ``` |
| 76 | + |
| 77 | +2. Restart Audit Daemon: |
| 78 | + ```shell |
| 79 | + sudo systemctl restart auditd |
| 80 | + ``` |
| 81 | + |
| 82 | +### Validation |
| 83 | + |
| 84 | +[Run the Agent's status subcommand][8] and look for `linux_audit_logs` under the Checks section. |
| 85 | +
|
| 86 | +## Data Collected |
| 87 | +
|
| 88 | +### Metrics |
| 89 | +
|
| 90 | +The Linux Audit Logs integration does not include any metrics. |
| 91 | +
|
| 92 | +### Log Collection |
| 93 | +
|
| 94 | +1. Collecting logs is disabled by default in the Datadog Agent. Enable it in the `datadog.yaml` file: |
| 95 | +
|
| 96 | + ```yaml |
| 97 | + logs_enabled: true |
| 98 | + ``` |
| 99 | +
|
| 100 | +2. Give the `dd-agent` user read access to the `audit.log` file: |
| 101 | +
|
| 102 | + ```shell |
| 103 | + sudo chown -R dd-agent:dd-agent /var/log/audit/audit.log |
| 104 | + ``` |
| 105 | +
|
| 106 | +3. Add this configuration block to your `linux_audit_logs.d/conf.yaml` file to start collecting Linux audit logs. |
| 107 | +
|
| 108 | + See the [sample linux_audit_logs.d/conf.yaml][7] for available configuration options. |
| 109 | +
|
| 110 | + ```yaml |
| 111 | + logs: |
| 112 | + - type: file |
| 113 | + path: /var/log/audit/audit.log |
| 114 | + service: linux-audit-logs |
| 115 | + source: linux-audit-logs |
| 116 | + ``` |
| 117 | + **Note**: Do not change the `service` and `source` values, as they are essential for proper log pipeline processing. |
| 118 | +
|
| 119 | +4. [Restart the Agent][2]. |
| 120 | +
|
| 121 | +### Events |
| 122 | +
|
| 123 | +The Linux Audit Logs integration does not include any events. |
| 124 | +
|
| 125 | +## Troubleshooting |
| 126 | +
|
| 127 | +Need help? Contact [Datadog support][1]. |
| 128 | +
|
| 129 | +[1]: https://docs.datadoghq.com/help/ |
| 130 | +[2]: https://docs.datadoghq.com/agent/guide/agent-commands/#start-stop-and-restart-the-agent |
| 131 | +[3]: https://linux.org/ |
| 132 | +[4]: https://docs.datadoghq.com/logs/explorer/ |
| 133 | +[5]: https://www.datadoghq.com/product/cloud-siem/ |
| 134 | +[6]: https://docs.datadoghq.com/agent/guide/integration-management/?tab=linux#install |
| 135 | +[7]: https://github.com/DataDog/integrations-core/blob/master/linux_audit_logs/datadog_checks/linux_audit_logs/data/conf.yaml.example |
| 136 | +[8]: https://docs.datadoghq.com/agent/guide/agent-commands/#agent-status-and-information |
0 commit comments