Skip to content

[Auditd Logs Integration]: user.name, user.target.name and user.effective.name not getting extracted for Account Lockout #20139

New issue
New issue
Closed
Closed
[Auditd Logs Integration]: user.name, user.target.name and user.effective.name not getting extracted for Account Lockout#20139
Labels
Integration:auditdAuditd LogsTeam:Security-Linux PlatformLinux Platform Security team [elastic/sec-linux-platform]needs:triage

Description

@rajsekharhaldar01-lang
rajsekharhaldar01-lang
opened on Jul 15, 2026

Integration Name

Auditd Logs [packages/auditd]

Dataset Name

auditd.log

Integration Version

3.23.0

Agent Version

8.16.5

Agent Output Type

logstash

Elasticsearch Version

9.3.3

OS Version and Architecture

Oracle Linux Server (x86_64)

Software/API Version

N/A

Error Message

There is no parsing error but the user related fields are under a wrong field name and we expect them to be under a different field name which are user related rather than auditd.log related , please see the below explanation-

In the below raw auditd log (present in sanitized form)-

"type=ACCT_LOCK msg=audit(1779274426.682:345678): pid=456789 uid=0 auid=1000 ses=4567 subj=unconfined_u:unconfined_r:passwd_t:s0-s0:c0.c1023 msg='op=locked-password id=20003 exe="/usr/bin/passwd" hostname=example-host-04.example.local addr=? terminal=pts/1 res=success'\u001dUID="root" AUID="example_admin" ID="example_locked_user"

  • the value in the field named as auditd.log.AUID should be copied over to the field called as user.name
  • the value in the in the field named as auditd.log.ID should be copied over to the field called as user.target.name
  • the value in the field named as auditd.log.UID should be copied over to the field called as user.effective.name

No customization to default/out of the box auditd ingest node pipeline was done.

  • the value in the field named as auditd.log.AUID is getting populated

  • the value in the in the field named as auditd.log.ID is getting populated

  • the value in the field named as auditd.log.UID is getting populated

  • the value in the field named as auditd.log.AUID should be copied over to the field called as user.name

  • the value in the in the field named as auditd.log.ID should be copied over to the field called as user.target.name

  • the value in the field named as auditd.log.UID should be copied over to the field called as user.effective.name

Event Original

The Actual parsed JSON document (with event.original sanitized)

{
  "_index": "partial-restored-.ds-logs-auditd.log-test-2026.05.19-001706",
  "_id": "exampleDocumentIdLockout01",
  "_version": 1,
  "_source": {
    "agent": {
      "name": "example-host-04.example.local",
      "id": "44444444-5555-4666-8777-888888888888",
      "ephemeral_id": "99999999-aaaa-4bbb-8ccc-333333333333",
      "type": "filebeat",
      "version": "8.16.5"
    },
    "process": {
      "pid": 456789,
      "executable": "/usr/bin/passwd"
    },
    "log": {
      "file": {
        "path": "/var/log/audit/audit.log"
      },
      "offset": 8765432
    },
    "elastic_agent": {
      "id": "44444444-5555-4666-8777-888888888888",
      "version": "8.16.5",
      "snapshot": false
    },
    "vertical": "example-vertical",
    "collection": {
      "method": "elasticagent"
    },
    "auditd": {
      "log": {
        "ses": "4567",
        "op": "locked-password",
        "record_type": "ACCT_LOCK",
        "sequence": 345678,
        "UID": "root",
        "AUID": "example_admin",
        "hostname": "example-host-04.example.local",
        "id": "20003",
        "ID": "example_locked_user",
        "subj": "unconfined_u:unconfined_r:passwd_t:s0-s0:c0.c1023"
      }
    },
    "tags": [
      "preserve_original_event",
      "auditd-log"
    ],
    "logstash": {
      "pipeline": "example-auditd-agent-test",
      "hostname": "example-logstash-03",
      "timestamp": "2026-05-20T10:54:42.461205Z"
    },
    "input": {
      "type": "log"
    },
    "bt": {
      "appid": "example-app"
    },
    "@timestamp": "2026-05-20T10:53:46.682Z",
    "ecs": {
      "version": "8.17.0"
    },
    "data_stream": {
      "namespace": "test",
      "type": "logs",
      "dataset": "auditd.log"
    },
    "kafka": {
      "partition": "1",
      "device": "empty"
    },
    "host": {
      "hostname": "example-host-04.example.local",
      "os": {
        "kernel": "5.15.0-205.149.5.1.el9uek.x86_64",
        "name": "Oracle Linux Server",
        "family": "redhat",
        "type": "linux",
        "version": "9.4",
        "platform": "ol"
      },
      "ip": [
        "192.0.2.40",
        "2001:db8::40"
      ],
      "containerized": false,
      "name": "example-host-04.example.local",
      "id": "dddddddd44444444eeeeeeee55555555",
      "mac": [
        "02-00-00-00-00-05"
      ],
      "architecture": "x86_64"
    },
    "@version": "1",
    "event": {
      "agent_id_status": "auth_metadata_missing",
      "ingested": "2026-05-20T10:54:42Z",
      "original": "type=ACCT_LOCK msg=audit(1779274426.682:345678): pid=456789 uid=0 auid=1000 ses=4567 subj=unconfined_u:unconfined_r:passwd_t:s0-s0:c0.c1023 msg='op=locked-password id=20003 exe=\"/usr/bin/passwd\" hostname=example-host-04.example.local addr=? terminal=pts/1 res=success'\u001dUID=\"root\" AUID=\"example_admin\" ID=\"example_locked_user\"",
      "kind": "event",
      "action": [
        "locked-account"
      ],
      "category": [
        "iam"
      ],
      "type": [
        "user",
        "info"
      ],
      "dataset": "auditd.log",
      "outcome": "success"
    },
    "user": {
      "audit": {
        "id": "1000"
      },
      "id": "0",
      "terminal": "pts/1"
    }
  },
  "fields": {
    "elastic_agent.version": [
      "8.16.5"
    ],
    "event.category": [
      "iam"
    ],
    "auditd.log.subj": [
      "unconfined_u:unconfined_r:passwd_t:s0-s0:c0.c1023"
    ],
    "host.os.name.text": [
      "Oracle Linux Server"
    ],
    "auditd.log.record_type": [
      "ACCT_LOCK"
    ],
    "host.hostname": [
      "example-host-04.example.local"
    ],
    "process.pid": [
      456789
    ],
    "host.mac": [
      "02-00-00-00-00-05"
    ],
    "logstash.pipeline": [
      "example-auditd-agent-test"
    ],
    "auditd.log.ID": [
      "example_locked_user"
    ],
    "auditd.log.id": [
      "20003"
    ],
    "agent.name.text": [
      "example-host-04.example.local"
    ],
    "host.os.version": [
      "9.4"
    ],
    "host.os.name": [
      "Oracle Linux Server"
    ],
    "agent.name": [
      "example-host-04.example.local"
    ],
    "auditd.log.hostname": [
      "example-host-04.example.local"
    ],
    "host.name": [
      "example-host-04.example.local"
    ],
    "event.agent_id_status": [
      "auth_metadata_missing"
    ],
    "event.kind": [
      "event"
    ],
    "event.outcome": [
      "success"
    ],
    "event.original": [
      "type=ACCT_LOCK msg=audit(1779274426.682:345678): pid=456789 uid=0 auid=1000 ses=4567 subj=unconfined_u:unconfined_r:passwd_t:s0-s0:c0.c1023 msg='op=locked-password id=20003 exe=\"/usr/bin/passwd\" hostname=example-host-04.example.local addr=? terminal=pts/1 res=success'\u001dUID=\"root\" AUID=\"example_admin\" ID=\"example_locked_user\""
    ],
    "host.os.type": [
      "linux"
    ],
    "user.id": [
      "0"
    ],
    "input.type": [
      "log"
    ],
    "log.offset": [
      8765432
    ],
    "data_stream.type": [
      "logs"
    ],
    "tags": [
      "preserve_original_event",
      "auditd-log"
    ],
    "host.architecture": [
      "x86_64"
    ],
    "agent.id": [
      "44444444-5555-4666-8777-888888888888"
    ],
    "ecs.version": [
      "8.17.0"
    ],
    "host.containerized": [
      false
    ],
    "agent.version": [
      "8.16.5"
    ],
    "host.os.family": [
      "redhat"
    ],
    "user.terminal": [
      "pts/1"
    ],
    "user.audit.id": [
      "1000"
    ],
    "auditd.log.op": [
      "locked-password"
    ],
    "vertical": [
      "example-vertical"
    ],
    "auditd.log.ses": [
      "4567"
    ],
    "logstash.hostname": [
      "example-logstash-03"
    ],
    "logstash.timestamp": [
      "2026-05-20T10:54:42.461Z"
    ],
    "host.ip": [
      "192.0.2.40",
      "2001:db8::40"
    ],
    "agent.type": [
      "filebeat"
    ],
    "process.executable.text": [
      "/usr/bin/passwd"
    ],
    "event.module": [
      "auditd"
    ],
    "host.os.kernel": [
      "5.15.0-205.149.5.1.el9uek.x86_64"
    ],
    "@version": [
      "1"
    ],
    "elastic_agent.snapshot": [
      false
    ],
    "host.id": [
      "dddddddd44444444eeeeeeee55555555"
    ],
    "process.executable": [
      "/usr/bin/passwd"
    ],
    "auditd.log.UID": [
      "root"
    ],
    "kafka.partition": [
      "1"
    ],
    "elastic_agent.id": [
      "44444444-5555-4666-8777-888888888888"
    ],
    "data_stream.namespace": [
      "test"
    ],
    "bt.appid": [
      "example-app"
    ],
    "event.action": [
      "locked-account"
    ],
    "event.ingested": [
      "2026-05-20T10:54:42.000Z"
    ],
    "@timestamp": [
      "2026-05-20T10:53:46.682Z"
    ],
    "host.os.platform": [
      "ol"
    ],
    "data_stream.dataset": [
      "auditd.log"
    ],
    "event.type": [
      "user",
      "info"
    ],
    "log.file.path": [
      "/var/log/audit/audit.log"
    ],
    "auditd.log.sequence": [
      345678
    ],
    "agent.ephemeral_id": [
      "99999999-aaaa-4bbb-8ccc-333333333333"
    ],
    "collection.method": [
      "elasticagent"
    ],
    "auditd.log.AUID": [
      "example_admin"
    ],
    "event.dataset": [
      "auditd.log"
    ],
    "kafka.device": [
      "empty"
    ]
  }
}

What did you do?

No customization to default/out of the box auditd ingest node pipeline was done.

What did you see?

  • the value in the field named as auditd.log.AUID is getting populated
  • the value in the in the field named as auditd.log.ID is getting populated
  • the value in the field named as auditd.log.UID is getting populated

What did you expect to see?

  • the value in the field named as auditd.log.AUID should be copied over to the field called as user.name
  • the value in the in the field named as auditd.log.ID should be copied over to the field called as user.target.name
  • the value in the field named as auditd.log.UID should be copied over to the field called as user.effective.name

Anything else?

N/A

Activity

  1. rajsekharhaldar01-lang
    added
    needs:triage
    on Jul 15, 2026
  2. andrewkroh
    added
    Integration:auditdAuditd Logs
    Team:Security-Linux PlatformLinux Platform Security team [elastic/sec-linux-platform]
    on Jul 15, 2026

  3. infra-vault-gh-plugin-prod commented on Jul 15, 2026

    @infra-vault-gh-plugin-prod
    infra-vault-gh-plugin-prodBot
    on Jul 15, 2026

    Pinging @elastic/sec-linux-platform (Team:Security-Linux Platform)

  4. nicholasberlin commented on Jul 23, 2026

    @nicholasberlin
    nicholasberlin
    on Jul 23, 2026
    Contributor

    Closed by: #20238

  5. nicholasberlin
    closed this as completedon Jul 23, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    Integration:auditdAuditd LogsTeam:Security-Linux PlatformLinux Platform Security team [elastic/sec-linux-platform]needs:triage

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions