[System] Fix system.auth IAM events event.outcome

packages/system/changelog.yml

@@ -1,4 +1,9 @@
 # later versions go on top
+- version: "3.3.1"
+  changes:
+    - description: Fix `system.auth` user and group management events being given `event.outcome` `failure` when the user name, home directory, or shell contains `fail`. Only messages that start with `fail` are now treated as failures.
+      type: bugfix
+      link: https://github.com/elastic/integrations/pull/22212
 - version: "3.3.0"
   changes:
     - description: Add a `start_position` advanced setting to the application, security, and system winlog data streams to skip events that already exist in the channel when no bookmark has been saved. Requires Elastic Agent 9.6.0 or later; earlier agents ignore it.

packages/system/data_stream/auth/_dev/test/pipeline/test-iam-fail-in-name.log

@@ -0,0 +1,2 @@
+2026-03-04T15:14:22.000000+00:00 host01 useradd[1001]: new user: name=faileduser, UID=16010, GID=16010, home=/home/faileduser, shell=/usr/local/fail/sh
+2026-03-04T15:14:23.000000+00:00 host01 useradd[1234]: failure while writing changes to /etc/passwd

packages/system/data_stream/auth/_dev/test/pipeline/test-iam-fail-in-name.log-config.yml

@@ -0,0 +1,2 @@
+fields:
+  input.type: log

packages/system/data_stream/auth/_dev/test/pipeline/test-iam-fail-in-name.log-expected.json

@@ -0,0 +1,97 @@
+{
+    "expected": [
+        {
+            "@timestamp": "2026-03-04T15:14:22.000Z",
+            "ecs": {
+                "version": "8.11.0"
+            },
+            "event": {
+                "action": "user-created",
+                "category": [
+                    "iam"
+                ],
+                "kind": "event",
+                "original": "2026-03-04T15:14:22.000000+00:00 host01 useradd[1001]: new user: name=faileduser, UID=16010, GID=16010, home=/home/faileduser, shell=/usr/local/fail/sh",
+                "outcome": "success",
+                "type": [
+                    "user",
+                    "creation"
+                ]
+            },
+            "group": {
+                "id": "16010"
+            },
+            "host": {
+                "hostname": "host01"
+            },
+            "input": {
+                "type": "log"
+            },
+            "message": "new user: name=faileduser, UID=16010, GID=16010, home=/home/faileduser, shell=/usr/local/fail/sh",
+            "process": {
+                "name": "useradd",
+                "pid": 1001
+            },
+            "related": {
+                "hosts": [
+                    "host01"
+                ],
+                "user": [
+                    "faileduser"
+                ]
+            },
+            "system": {
+                "auth": {
+                    "useradd": {
+                        "home": "/home/faileduser",
+                        "shell": "/usr/local/fail/sh"
+                    }
+                }
+            },
+            "user": {
+                "target": {
+                    "id": "16010",
+                    "name": "faileduser"
+                }
+            }
+        },
+        {
+            "@timestamp": "2026-03-04T15:14:23.000Z",
+            "ecs": {
+                "version": "8.11.0"
+            },
+            "event": {
+                "action": "user-created",
+                "category": [
+                    "iam"
+                ],
+                "kind": "event",
+                "original": "2026-03-04T15:14:23.000000+00:00 host01 useradd[1234]: failure while writing changes to /etc/passwd",
+                "outcome": "failure",
+                "type": [
+                    "user",
+                    "creation"
+                ]
+            },
+            "host": {
+                "hostname": "host01"
+            },
+            "input": {
+                "type": "log"
+            },
+            "message": "failure while writing changes to /etc/passwd",
+            "process": {
+                "name": "useradd",
+                "pid": 1234
+            },
+            "related": {
+                "hosts": [
+                    "host01"
+                ]
+            },
+            "system": {
+                "auth": {}
+            }
+        }
+    ]
+}

packages/system/data_stream/auth/elasticsearch/ingest_pipeline/message.yml

@@ -637,12 +637,12 @@ processors:
       tag: set_outcome-success
       field: event.outcome
       value: success
-      if: ctx.process?.name != null && (ctx.message == null || !ctx.message.contains("fail")) && ['groupadd', 'groupdel', 'groupmod', 'useradd', 'userdel', 'usermod'].contains(ctx.process.name)
+      if: ctx.process?.name != null && (ctx.message == null || !ctx.message.startsWith("fail")) && ['groupadd', 'groupdel', 'groupmod', 'useradd', 'userdel', 'usermod'].contains(ctx.process.name)
   - set:
       tag: set_outcome-failure
       field: event.outcome
       value: failure
-      if: ctx.process?.name != null && (ctx.message != null && ctx.message.contains("fail")) && ['groupadd', 'groupdel', 'groupmod', 'useradd', 'userdel', 'usermod'].contains(ctx.process.name)
+      if: ctx.process?.name != null && (ctx.message != null && ctx.message.startsWith("fail")) && ['groupadd', 'groupdel', 'groupmod', 'useradd', 'userdel', 'usermod'].contains(ctx.process.name)
   - append:
       tag: append_type-user
       field: event.type

packages/system/manifest.yml

@@ -1,7 +1,7 @@
 format_version: 3.4.0
 name: system
 title: System
-version: "3.3.0"
+version: "3.3.1"
 description: Collect system logs and metrics from your servers with Elastic Agent.
 type: integration
 categories: