DDS: Linux Audit Logs Updates by tirthrajchaudhari-crest · Pull Request #20345 · DataDog/integrations-core

tirthrajchaudhari-crest · 2025-05-21T12:33:23Z

What does this PR do?

Added support for SYSCALL logs
Updated the pipeline
Added system calls dashboard
Update README to include setup steps for audit rules

Review checklist (to be filled by reviewers)

Feature or bugfix MUST have appropriate tests (unit, integration, e2e)
Add the qa/skip-qa label if the PR doesn't need to be tested during QA.
If you need to backport this PR to another branch, you can add the backport/<branch-name> label to the PR and it will automatically open a backport PR once this one is merged

rtrieu

thank you for contributing to our docs! i've left some feedback mainly to comply with our style guide.

rtrieu · 2025-05-21T19:49:08Z


+### Setup Audit Rules (Optional)
+
+1. Create/Edit the Audit Rules File


Suggested change

1. Create/Edit the Audit Rules File

1. Create or edit the Audit Rules file:

rtrieu · 2025-05-21T19:50:48Z

    sudo systemctl restart auditd
    ```

+### Setup Audit Rules (Optional)


Suggested change

### Setup Audit Rules (Optional)

### Set up Audit Rules (optional)

rtrieu · 2025-05-21T19:51:14Z

+    sudo nano /etc/audit/rules.d/audit.rules
+    ```
+
+2. Configure the audit rules based on your requirements. For reference, check out [audit rulesets][9].


Suggested change

2. Configure the audit rules based on your requirements. For reference, check out [audit rulesets][9].

2. Configure the audit rules based on your requirements. For reference, see [audit rulesets][9].

rtrieu · 2025-05-21T19:51:22Z

+
+2. Configure the audit rules based on your requirements. For reference, check out [audit rulesets][9].
+
+3. Reload Audit Rules


Suggested change

3. Reload Audit Rules

3. Reload Audit Rules:

rtrieu · 2025-05-21T19:51:31Z

+    sudo augenrules --load
+    ```
+
+4. Verify Loaded Rules


Suggested change

4. Verify Loaded Rules

4. Verify loaded rules:

buraizu

Approving with one minor update requested for screen-reader accessibility, as well as some additional suggestions for consistency with casing and punctuation.

buraizu · 2025-05-21T19:43:26Z


+### Setup Audit Rules (Optional)
+
+1. Create/Edit the Audit Rules File


Suggested change

1. Create/Edit the Audit Rules File

1. Create or Edit the audit rules file.

buraizu · 2025-05-21T19:53:10Z

+
+2. Configure the audit rules based on your requirements. For reference, check out [audit rulesets][9].
+
+3. Reload Audit Rules


Suggested change

3. Reload Audit Rules

3. Reload audit rules.

buraizu · 2025-05-21T19:54:51Z

+    sudo augenrules --load
+    ```
+
+4. Verify Loaded Rules


Suggested change

4. Verify Loaded Rules

4. Verify loaded rules.

buraizu · 2025-05-21T19:55:32Z

+
+3. Reload Audit Rules
+    ```shell
+    sudo augenrules --load


Just want to confirm that augenrules is the correct spelling.

Yes, it's the correct spelling.

Review from buraizu is dismissed. Related teams and files:

documentation
- linux_audit_logs/README.md

tirthrajchaudhari-crest · 2025-05-22T05:53:14Z

Hey @rtrieu @buraizu, Both changes look good, but for now, we are proceeding with using a colon after the setup step statements.

Review from buraizu is dismissed. Related teams and files:

documentation
- linux_audit_logs/manifest.json

Review from rtrieu is dismissed. Related teams and files:

documentation
- linux_audit_logs/manifest.json

…into linux-audit-logs-update

github-actions · 2025-09-19T09:25:22Z

⚠️ Recommendation: Add qa/skip-qa label

This PR does not modify any files shipped with the agent.

To help streamline the release process, please consider adding the qa/skip-qa label if these changes do not require QA testing.

brunorenier · 2025-11-06T12:56:10Z

+        - name: Lookup on `success` to `result` Field
+          enabled: true
+          source: success
+          target: result


This field doesn't seem to be used for the status remapper later on (here) which means you are not using it for the status of the log.

Is that expected?

We have made a minor update in the log pipeline so that this field will be used to map the status for the log.

…into linux-audit-logs-update

brunorenier

LGTM for logs-core

nubtron · 2025-11-07T15:21:45Z

Could you add a dark mode screenshot for the dashboard?

This is just a update PR for this integration and we usually add only ligh themed dashboard screenshots in tile.

@tirthrajchaudhari-crest, we’ve recently updated our guidelines for integration tiles - screenshots should now include a dark mode view and show a high volume of logs to better represent real-world usage. Could you please update the existing screenshots accordingly?

Also, could you ensure that the aspect ratio looks correct (for example, circles shouldn’t appear distorted)?

@nubtron We have updated the dashboard images which now includes light and dark version of images with high volume of logs.

@tirthrajchaudhari-crest thank you!

Update integration as per the comment

d9068ac

temporal-github-worker-1 Bot added docs/review-requested ecosystems/review-requested product/review-requested labels May 21, 2025

datadog-agent-integrations-bot Bot added documentation integration/linux_audit_logs labels May 21, 2025

Update test result

46307da

tirthrajchaudhari-crest marked this pull request as ready for review May 21, 2025 12:55

tirthrajchaudhari-crest requested review from a team as code owners May 21, 2025 12:55

datadog-agent-integrations-bot Bot added team/agent-integrations team/documentation team/logs-backend team/logs-integrations-reviewers labels May 21, 2025

rtrieu requested changes May 21, 2025

View reviewed changes

temporal-github-worker-1 Bot added docs/requested-changes and removed docs/review-requested labels May 21, 2025

buraizu previously approved these changes May 21, 2025

View reviewed changes

temporal-github-worker-1 Bot added docs/approved and removed docs/requested-changes labels May 21, 2025

Address review comments

772f4d5

temporal-github-worker-1 Bot added docs/review-requested and removed docs/approved labels May 22, 2025

tirthrajchaudhari-crest requested review from buraizu and rtrieu May 22, 2025 05:53

buraizu previously approved these changes May 22, 2025

View reviewed changes

temporal-github-worker-1 Bot added docs/approved and removed docs/review-requested labels May 22, 2025

rtrieu previously approved these changes May 28, 2025

View reviewed changes

Add extra category in manifest file

09aa57e

temporal-github-worker-1 Bot added docs/review-requested and removed docs/approved labels Sep 19, 2025

Merge branch 'master' of https://github.com/DataDog/integrations-core …

a4ab562

…into linux-audit-logs-update

brunorenier reviewed Nov 6, 2025

View reviewed changes

tirthrajchaudhari-crest added 3 commits November 7, 2025 12:28

Address review comment

e9f2724

Merge branch 'master' of https://github.com/DataDog/integrations-core …

a7bb1b3

…into linux-audit-logs-update

Update test result

7dce638

brunorenier approved these changes Nov 7, 2025

View reviewed changes

nubtron requested changes Nov 7, 2025

View reviewed changes

tirthrajchaudhari-crest requested a review from nubtron November 10, 2025 09:35

UUpdate dashboard images

a3c5c19

temporal-github-worker-1 Bot added the agent/requested-changes label Nov 11, 2025

nubtron approved these changes Nov 17, 2025

View reviewed changes

temporal-github-worker-1 Bot added agent/approved and removed agent/requested-changes labels Nov 17, 2025

rtrieu approved these changes Nov 18, 2025

View reviewed changes

temporal-github-worker-1 Bot added docs/approved and removed docs/review-requested labels Nov 18, 2025


		### Setup Audit Rules (Optional)

		1. Create/Edit the Audit Rules File

	1. Create/Edit the Audit Rules File
	1. Create or edit the Audit Rules file:

	### Setup Audit Rules (Optional)
	### Set up Audit Rules (optional)

	2. Configure the audit rules based on your requirements. For reference, check out [audit rulesets][9].
	2. Configure the audit rules based on your requirements. For reference, see [audit rulesets][9].


		2. Configure the audit rules based on your requirements. For reference, check out [audit rulesets][9].

		3. Reload Audit Rules

	1. Create/Edit the Audit Rules File
	1. Create or Edit the audit rules file.

Conversation

tirthrajchaudhari-crest commented May 21, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What does this PR do?

Review checklist (to be filled by reviewers)

Uh oh!

rtrieu left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

buraizu left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

tirthrajchaudhari-crest commented May 22, 2025

Uh oh!

github-actions Bot commented Sep 19, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

brunorenier left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

tirthrajchaudhari-crest commented May 21, 2025 •

edited

Loading

github-actions Bot commented Sep 19, 2025 •

edited

Loading