Skip to content
Snippets Groups Projects
Unverified Commit 075c2488 authored by micah's avatar micah
Browse files

disable auditd when loki is enabled, its structured logs are not so easily 

parsed by loki
parent dd7b60fb
No related branches found
No related tags found
1 merge request!110Draft: Enable Loki as a replacement for Elasticsearch when `enable_loki` is set.
Show whitespace changes
Inline Side-by-side
roles/base/tasks/harden.yml
+ 6
− 0
View file @ 075c2488
...@@ -49,6 +49,7 @@ ...@@ -49,6 +49,7 @@
packages: packages:
- auditd - auditd
- audisp-json - audisp-json
when: not enable_loki
- name: Auditd default config removed - name: Auditd default config removed
file: file:
...@@ -63,6 +64,7 @@ ...@@ -63,6 +64,7 @@
- "templates/audit/rules.d/*.j2" - "templates/audit/rules.d/*.j2"
notify: notify:
- restart auditd - restart auditd
when: not enable_loki
- name: Auditd configured - name: Auditd configured
template: template:
...@@ -70,6 +72,7 @@ ...@@ -70,6 +72,7 @@
dest: /etc/audit/auditd.conf dest: /etc/audit/auditd.conf
notify: notify:
- restart auditd - restart auditd
when: not enable_loki
- name: Audispd plugins configured - name: Audispd plugins configured
copy: copy:
...@@ -80,11 +83,13 @@ ...@@ -80,11 +83,13 @@
- json.conf - json.conf
notify: notify:
- restart auditd - restart auditd
when: not enable_loki
- name: Enable auditd service - name: Enable auditd service
systemd: systemd:
name: auditd.service name: auditd.service
enabled: yes enabled: yes
when: not enable_loki
- name: Disable journald-auditd link - name: Disable journald-auditd link
systemd: systemd:
...@@ -92,3 +97,4 @@ ...@@ -92,3 +97,4 @@
state: stopped state: stopped
enabled: no enabled: no
masked: yes masked: yes
when: not enable_loki
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Please register or to comment