Hello,
Last week I saw (based on an slack message https://elasticstack.slack.com/archives/C02J2JBS0FP/p1712234933586649) that when creating a user in Linux (version 1.54 of system integration) the process.name was not properly populated.
The event.category and event.type is set based on the value of the process name and therefore the events were without category/type
What I have observed is that the value of the process is set in log.syslog.appname, but I'm not able to find references to this field in the pipeline.
Also, doing a pipeline simulation the field log.syslog.appname is not set... so I do not understand
The event original is this one
Apr 4 15:13:14 serverxyz useradd[2586]: new user: name=testoriginal, UID=6185, GID=6185, home=/home/testoriginal, shell=/bin/bash
What is wrong? What is the origin of the field log.syslog.appname?
Hello,
Last week I saw (based on an slack message https://elasticstack.slack.com/archives/C02J2JBS0FP/p1712234933586649) that when creating a user in Linux (version 1.54 of system integration) the process.name was not properly populated.
The event.category and event.type is set based on the value of the process name and therefore the events were without category/type
What I have observed is that the value of the process is set in log.syslog.appname, but I'm not able to find references to this field in the pipeline.
Also, doing a pipeline simulation the field log.syslog.appname is not set... so I do not understand
The event original is this one
Apr 4 15:13:14 serverxyz useradd[2586]: new user: name=testoriginal, UID=6185, GID=6185, home=/home/testoriginal, shell=/bin/bashWhat is wrong? What is the origin of the field log.syslog.appname?