(Simple) Feature Request - adapting the auditd work from an existing repo

[nnWhisperer]

Component(s)

No response

Is your feature request related to a problem? Please describe.

Hello,
Thank you for the good work with the tool you are developing. It would be even better to add an auditd exporter/processor.
I imagine that adding such a feature is desirable to make the monitored system safer, plus would make your work even more valuable I suppose.

Describe the solution you'd like

Filebeat provides an auditd exporter/processor. Their source code is Apache 2.0 licensed too and the processing is done here
On the implementation side, it seems quite easy to implement the same logic by taking it from the filebeat's source code. There can be some adaption needed, but it will probably be something like renaming some of the fields. I believe a developer can do it in 1-2 days.

Describe alternatives you've considered

Originally the request was posted here. And a suggestion was to use regexes to do parsing, which isn't feature complete as filebeat and error-prone(the filebeat version has unit-tests AFAIR).

Additional context

Thanks

[axw]

@nnWhisperer if I understand correctly what you really want is a receiver. That is, something that can consume, parse, and send auditd logs down the pipeline.

Can you please open a "new component" issue using the following template? https://github.com/open-telemetry/opentelemetry-collector-contrib/issues/new?assignees=&labels=Sponsor+Needed%2Cneeds+triage&projects=&template=new_component.yaml&title=New+component%3A+

You should capture in there a rough sketch of what you think the configuration should look like, and the scope what it should do.

Thank you.

[nnWhisperer]

I've already opened another task and I was referred to open one here and now I'm referred to open another :(

[axw]

I did hesitate to ask, but this is the project's process, and it's unlikely anything would have happened without following it.

Thanks for opening the new issue, I will bring it to the attention of some folks at Elastic who may be interested in porting the auditbeat functionality.