@cryptotaxi247 / netdata
Code Commits Issues Pulls Sessions CI/CD
master
master
md 147 lines 4.51 KB
Rendered Raw
1 <!--startmeta
2 custom_edit_url: "https://github.com/netdata/netdata/edit/master/src/collectors/debugfs.plugin/integrations/linux_audit_subsystem.md"
3 meta_yaml: "https://github.com/netdata/netdata/edit/master/src/collectors/debugfs.plugin/metadata.yaml"
4 sidebar_label: "Linux Audit Subsystem"
5 learn_status: "Published"
6 learn_rel_path: "Collecting Metrics/Collectors/Operating Systems"
7 keywords: ['audit', 'auditd', 'backlog', 'security', 'kernel panic', 'compliance']
8 message: "DO NOT EDIT THIS FILE DIRECTLY, IT IS GENERATED BY THE COLLECTOR'S metadata.yaml FILE"
9 endmeta-->
10
11 # Linux Audit Subsystem
12
13
14 <img src="https://netdata.cloud/img/linux.svg" width="150"/>
15
16
17 Plugin: debugfs.plugin
18 Module: audit
19
20 <img src="https://img.shields.io/badge/maintained%20by-Netdata-%2300ab44" />
21
22 ## Overview
23
24 Monitors Linux kernel audit subsystem status via NETLINK_AUDIT. Tracks audit backlog depth, backlog utilization, lost events, and configuration (failure mode, enabled state). Critical for detecting audit backlog overflow conditions that cause kernel panics when failure mode is set to 2 (panic).
25
26
27 Query kernel audit status via NETLINK_AUDIT socket (AUDIT_GET)
28
29 This collector is only supported on the following platforms:
30
31 - Linux
32
33 This collector only supports collecting metrics from a single instance of this integration.
34
35 This integration requires root privileges or CAP_AUDIT_CONTROL capability to query the kernel audit subsystem via netlink. The Netdata installer grants this capability to debugfs.plugin automatically. The module detects missing privileges and disables itself gracefully.
36
37
38 ### Default Behavior
39
40 #### Auto-Detection
41
42 Automatically detects and monitors the Linux audit subsystem when the kernel supports NETLINK_AUDIT. Gracefully disables itself if audit is not available.
43
44
45 #### Limits
46
47 The default configuration for this integration does not impose any limits on data collection.
48
49 #### Performance Impact
50
51 Minimal. Performs a single netlink query per collection cycle. No file I/O, no process forking.
52
53
54 ## Setup
55
56
57 ### Prerequisites
58
59 #### Linux kernel with audit support
60
61 The Linux kernel must have audit support enabled (CONFIG_AUDIT=y). Most distribution kernels include this by default.
62
63
64
65 ### Configuration
66
67 #### Options
68
69
70
71 <details open><summary>Config options</summary>
72
73
74
75 | Option | Description | Default | Required |
76 |:-----|:------------|:--------|:---------:|
77 | update every | Data collection frequency. | 1 | no |
78
79
80 </details>
81
82
83
84 #### via File
85
86 The configuration file name for this integration is `netdata.conf`.
87 Configuration for this specific integration is located in the `[plugin:debugfs]` section within that file.
88
89 The file format is a modified INI syntax. The general structure is:
90
91 ```ini
92 [section1]
93 option1 = some value
94 option2 = some other value
95
96 [section2]
97 option3 = some third value
98 ```
99 You can edit the configuration file using the [`edit-config`](https://github.com/netdata/netdata/blob/master/docs/netdata-agent/configuration/README.md#edit-configuration-files) script from the
100 Netdata [config directory](https://github.com/netdata/netdata/blob/master/docs/netdata-agent/configuration/README.md#locate-your-config-directory).
101
102 ```bash
103 cd /etc/netdata 2>/dev/null || cd /opt/netdata/etc/netdata
104 sudo ./edit-config netdata.conf
105 ```
106
107 ##### Examples
108 There are no configuration examples.
109
110
111
112 ## Alerts
113
114
115 The following alerts are available:
116
117 | Alert name | On metric | Description |
118 |:------------|:----------|:------------|
119 | [ audit_backlog_utilization ](https://github.com/netdata/netdata/blob/master/src/health/health.d/audit.conf) | audit.backlog_utilization | Linux audit backlog utilization has exceeded the warning threshold while failure mode is set to panic. Kernel panic is imminent if backlog overflows. |
120 | [ audit_lost_events ](https://github.com/netdata/netdata/blob/master/src/health/health.d/audit.conf) | audit.lost | Linux audit subsystem is losing events (backlog overflow, rate limiting, or memory pressure). |
121
122
123 ## Metrics
124
125 Metrics grouped by *scope*.
126
127 The scope defines the instance that the metric belongs to. An instance is uniquely identified by a set of labels.
128
129 Monitor the Linux kernel audit subsystem status and backlog health.
130
131 ### Per Linux Audit Subsystem instance
132
133 Audit subsystem status for the entire system.
134
135 This scope has no labels.
136
137 Metrics:
138
139 | Metric | Dimensions | Unit |
140 |:------|:----------|:----|
141 | audit.backlog | used, free | events |
142 | audit.backlog_utilization | utilization | % |
143 | audit.lost | lost | events/s |
144 | audit.enabled | disabled, enabled, immutable | state |
145 | audit.failure | silent, printk, panic | state |
146
147