Giters

elastic / elastic-agent

Elastic Agent - single, unified way to add monitoring for logs, metrics, and other types of data to a host.

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

`system.security` dataset is not generated for Windows agent installed with unprivileged flag.

amolnater-qasource opened this issue · comments

commented

Kibana Build details:

VERSION: 8.14.0 BC2
BUILD: 73626
COMMIT: bcf6960778ae270d0894a8aab07f10197ee9b97f

Preconditions:

  1. 8.14.0-BC2 Kibana cloud environment should be available.
  2. Agent should be installed with unprivileged flag.

Steps to reproduce:

  1. Navigate to Data Streams tab.
  2. Observe logs for system integration and system.security dataset is not generated.

Expected Result:
system.security dataset should be generated for Windows agent installed with unprivileged flag.

What's working fine:

  • system.security dataset is generated for Windows agent installed without unprivileged flag.

Screenshot:
image

commented

Pinging @elastic/elastic-agent-control-plane (Team:Elastic-Agent-Control-Plane)

commented

secondary review is done

commented

I suspect this will be related to the permissions of the new unprivileged user.

Can you upload diagnostics when this happens?

commented

odds are really good that the new unprivileged user needs to be a member of the "Event Log Readers" group.

commented

It was agreed that the Administrator performing the installation will add the elastic-agent-user to the groups that they want the Elastic Agent to have access to.

I don't know exactly which group is needed to read that data, so I would try @leehinman suggestion.

commented

Hi Team,

Thank you for looking into this issue.

Please find below agent diagnostics for the installed agent:
elastic-agent-diagnostics-2024-05-02T06-10-30Z-00.zip

Please let us know if anything else is required from our end.
Thanks!!

commented

It was agreed that the Administrator performing the installation will add the elastic-agent-user to the groups that they want the Elastic Agent to have access to.

I don't know exactly which group is needed to read that data, so I would try @leehinman suggestion.

@blakerouse are there any other steps during installation that the user needs to perform? not just for this issue but generally speaking. I want to make sure we can comprehensively document these.

cc: @kilfoyle

commented

@amolnater-qasource Did you get a chance to try @leehinman's suggestion? If it works, we can document it as a pre-requisite for running Agent in unprivileged mode.

commented

@nimarezainia @blakerouse @kilfoyle I've created #4705 to start collecting in a single place all prerequisites required for successfully running Agent in unprivileged mode. @blakerouse could you please populate the table in that issue as you discover prerequisites? @kilfoyle your call on how best to take the information in that table and present it in our user-facing documentation. Thanks!

commented

thank you @ycombinator. We would need instructions on how the user could change the privilege level (that are OS specific) for some of the major operating systems.

the use case: In Fleet, we inform the user that an input is not working due to privilege. The idea was to provide them some instructions on how to change the priv level to be able to read the data source.