Skip to content

Commit 221c3f5

Browse files
KbayeroAlexSanchez-bitJocLRojas
authored
Release/v11.2.8 (#2083)
* fix[frontend](settings): sending email configuration parameters on check * fix[frontend](integrations_guides): updated eset integration images * add correct status code for authentication errors * fix[frontend](alerts-view): setted echoes column as readonly (not sortered) * fix[frontend](alerts-view): added last echoe timestamp to alerts that have echoes * fix[frontend](integrations/json):updated json input guide * fix[backend](collectors): avoid sending masked values to collectors * fix[backend](csv_export): fixed csv export to include composed columns (adversary,etc) * fix[frontend](tagging rules): fixed tagging rules ocnditions check * fix[frontend](logexplorer): fixed sidebar selected fielrs and available filters menu proportion * fix[frontend](ciscoswitch_integration): removed fixed integration name from guide * deleted: rule Office 365 Impossible Travel Login Detection removed from o365 * feat(filters/fortinet): add CEF format support to fortigate filter * fix[ci]: build agent with CGO disabled * fix[installer]: generate complex password for OpenSearch * update golang dependencies * fix[agent](auditd): treat unavailable audit subsystem as skip, not error * fix[backend](collectors): enforce sending clear text passwords to collector * fix[frontend](integration_guides): restored linux agent install path * fix[backend](alerts): added last echoe field on alerts * fix[frontend](alerts): added last echoe timestamp to alert table --------- Co-authored-by: AlexSanchez-bit <sanchez.saez.alex01@gmail.com> Co-authored-by: JocLRojas <joc.l.rojas02@gmail.com>
1 parent e2993fc commit 221c3f5

88 files changed

Lines changed: 2055 additions & 1497 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.github/workflows/v11-deployment-pipeline.yml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -134,6 +134,7 @@ jobs:
134134
env:
135135
GOOS: linux
136136
GOARCH: amd64
137+
CGO_ENABLED: 0
137138
run: |
138139
cd ${{ github.workspace }}/agent
139140
go build -o utmstack_agent_service_linux_amd64 -v -ldflags "-X 'github.com/utmstack/UTMStack/agent/config.REPLACE_KEY=${{ secrets.AGENT_SECRET_PREFIX }}'" .
@@ -145,6 +146,7 @@ jobs:
145146
env:
146147
GOOS: linux
147148
GOARCH: arm64
149+
CGO_ENABLED: 0
148150
run: |
149151
cd ${{ github.workspace }}/agent
150152
go build -o utmstack_agent_service_linux_arm64 -v -ldflags "-X 'github.com/utmstack/UTMStack/agent/config.REPLACE_KEY=${{ secrets.AGENT_SECRET_PREFIX }}'" .
@@ -156,6 +158,7 @@ jobs:
156158
env:
157159
GOOS: windows
158160
GOARCH: amd64
161+
CGO_ENABLED: 0
159162
run: |
160163
cd ${{ github.workspace }}/agent
161164
go build -o utmstack_agent_service_windows_amd64.exe -v -ldflags "-X 'github.com/utmstack/UTMStack/agent/config.REPLACE_KEY=${{ secrets.AGENT_SECRET_PREFIX }}'" .
@@ -167,6 +170,7 @@ jobs:
167170
env:
168171
GOOS: windows
169172
GOARCH: arm64
173+
CGO_ENABLED: 0
170174
run: |
171175
cd ${{ github.workspace }}/agent
172176
go build -o utmstack_agent_service_windows_arm64.exe -v -ldflags "-X 'github.com/utmstack/UTMStack/agent/config.REPLACE_KEY=${{ secrets.AGENT_SECRET_PREFIX }}'" .

‎agent-manager/go.mod‎

Lines changed: 12 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -4,15 +4,17 @@ go 1.25.5
44

55
require (
66
github.com/AtlasInsideCorp/AtlasInsideAES v1.0.0
7-
github.com/gin-gonic/gin v1.11.0
7+
github.com/gin-gonic/gin v1.12.0
88
github.com/google/uuid v1.6.0
99
github.com/utmstack/config-client-go v1.2.7
10-
google.golang.org/grpc v1.79.1
10+
google.golang.org/grpc v1.81.1
1111
google.golang.org/protobuf v1.36.11
1212
gorm.io/driver/postgres v1.6.0
1313
gorm.io/gorm v1.31.1
1414
)
1515

16+
require go.mongodb.org/mongo-driver/v2 v2.5.0 // indirect
17+
1618
require (
1719
github.com/bytedance/gopkg v0.1.3 // indirect
1820
github.com/bytedance/sonic v1.15.0 // indirect
@@ -40,14 +42,14 @@ require (
4042
github.com/pelletier/go-toml/v2 v2.2.4 // indirect
4143
github.com/quic-go/qpack v0.6.0 // indirect
4244
github.com/quic-go/quic-go v0.59.0 // indirect
43-
github.com/threatwinds/go-sdk v1.1.14
45+
github.com/threatwinds/go-sdk v1.1.21
4446
github.com/twitchyliquid64/golang-asm v0.15.1 // indirect
4547
github.com/ugorji/go/codec v1.3.1 // indirect
46-
golang.org/x/arch v0.23.0 // indirect
47-
golang.org/x/crypto v0.47.0 // indirect
48-
golang.org/x/net v0.49.0 // indirect
49-
golang.org/x/sync v0.19.0 // indirect
50-
golang.org/x/sys v0.40.0 // indirect
51-
golang.org/x/text v0.33.0 // indirect
52-
google.golang.org/genproto/googleapis/rpc v0.0.0-20260203192932-546029d2fa20 // indirect
48+
golang.org/x/arch v0.24.0 // indirect
49+
golang.org/x/crypto v0.49.0 // indirect
50+
golang.org/x/net v0.52.0 // indirect
51+
golang.org/x/sync v0.20.0 // indirect
52+
golang.org/x/sys v0.42.0 // indirect
53+
golang.org/x/text v0.35.0 // indirect
54+
google.golang.org/genproto/googleapis/rpc v0.0.0-20260226221140-a57be14db171 // indirect
5355
)

‎agent-manager/go.sum‎

Lines changed: 34 additions & 32 deletions
Original file line numberDiff line numberDiff line change
@@ -18,8 +18,8 @@ github.com/gabriel-vasile/mimetype v1.4.13 h1:46nXokslUBsAJE/wMsp5gtO500a4F3Nkz9
1818
github.com/gabriel-vasile/mimetype v1.4.13/go.mod h1:d+9Oxyo1wTzWdyVUPMmXFvp4F9tea18J8ufA774AB3s=
1919
github.com/gin-contrib/sse v1.1.0 h1:n0w2GMuUpWDVp7qSpvze6fAu9iRxJY4Hmj6AmBOU05w=
2020
github.com/gin-contrib/sse v1.1.0/go.mod h1:hxRZ5gVpWMT7Z0B0gSNYqqsSCNIJMjzvm6fqCz9vjwM=
21-
github.com/gin-gonic/gin v1.11.0 h1:OW/6PLjyusp2PPXtyxKHU0RbX6I/l28FTdDlae5ueWk=
22-
github.com/gin-gonic/gin v1.11.0/go.mod h1:+iq/FyxlGzII0KHiBGjuNn4UNENUlKbGlNmc+W50Dls=
21+
github.com/gin-gonic/gin v1.12.0 h1:b3YAbrZtnf8N//yjKeU2+MQsh2mY5htkZidOM7O0wG8=
22+
github.com/gin-gonic/gin v1.12.0/go.mod h1:VxccKfsSllpKshkBWgVgRniFFAzFb9csfngsqANjnLc=
2323
github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI=
2424
github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
2525
github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
@@ -89,47 +89,49 @@ github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXl
8989
github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
9090
github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
9191
github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
92-
github.com/threatwinds/go-sdk v1.1.14 h1:9XqqGPZvDHHuJ/XkfMsDl3fe7Adfi1fMh/PpQFkUkJU=
93-
github.com/threatwinds/go-sdk v1.1.14/go.mod h1:Kfu26gkSZDpNNkPvuQbTAW3dWIQ66pVIrNYW1YBG3Kg=
92+
github.com/threatwinds/go-sdk v1.1.21 h1:ZT/6Rb9szOLzXZdUgSa9eSDD4f5ljNDdzBWvR8hXTIE=
93+
github.com/threatwinds/go-sdk v1.1.21/go.mod h1:kuU3op/tHVgoDhVeP4KHvyHXQKWSmmdEwJPUr0sGRLI=
9494
github.com/twitchyliquid64/golang-asm v0.15.1 h1:SU5vSMR7hnwNxj24w34ZyCi/FmDZTkS4MhqMhdFk5YI=
9595
github.com/twitchyliquid64/golang-asm v0.15.1/go.mod h1:a1lVb/DtPvCB8fslRZhAngC2+aY1QWCk3Cedj/Gdt08=
9696
github.com/ugorji/go/codec v1.3.1 h1:waO7eEiFDwidsBN6agj1vJQ4AG7lh2yqXyOXqhgQuyY=
9797
github.com/ugorji/go/codec v1.3.1/go.mod h1:pRBVtBSKl77K30Bv8R2P+cLSGaTtex6fsA2Wjqmfxj4=
9898
github.com/utmstack/config-client-go v1.2.7 h1:JeRdI5JjH1liNzMW3LmyevjuPd67J/yt9MAO3+oJAuM=
9999
github.com/utmstack/config-client-go v1.2.7/go.mod h1:kM0KoUizM9ZlcQp0qKviGTWn/+anT5Rfjx3zfZk79nM=
100+
go.mongodb.org/mongo-driver/v2 v2.5.0 h1:yXUhImUjjAInNcpTcAlPHiT7bIXhshCTL3jVBkF3xaE=
101+
go.mongodb.org/mongo-driver/v2 v2.5.0/go.mod h1:yOI9kBsufol30iFsl1slpdq1I0eHPzybRWdyYUs8K/0=
100102
go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64=
101103
go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y=
102-
go.opentelemetry.io/otel v1.39.0 h1:8yPrr/S0ND9QEfTfdP9V+SiwT4E0G7Y5MO7p85nis48=
103-
go.opentelemetry.io/otel v1.39.0/go.mod h1:kLlFTywNWrFyEdH0oj2xK0bFYZtHRYUdv1NklR/tgc8=
104-
go.opentelemetry.io/otel/metric v1.39.0 h1:d1UzonvEZriVfpNKEVmHXbdf909uGTOQjA0HF0Ls5Q0=
105-
go.opentelemetry.io/otel/metric v1.39.0/go.mod h1:jrZSWL33sD7bBxg1xjrqyDjnuzTUB0x1nBERXd7Ftcs=
106-
go.opentelemetry.io/otel/sdk v1.39.0 h1:nMLYcjVsvdui1B/4FRkwjzoRVsMK8uL/cj0OyhKzt18=
107-
go.opentelemetry.io/otel/sdk v1.39.0/go.mod h1:vDojkC4/jsTJsE+kh+LXYQlbL8CgrEcwmt1ENZszdJE=
108-
go.opentelemetry.io/otel/sdk/metric v1.39.0 h1:cXMVVFVgsIf2YL6QkRF4Urbr/aMInf+2WKg+sEJTtB8=
109-
go.opentelemetry.io/otel/sdk/metric v1.39.0/go.mod h1:xq9HEVH7qeX69/JnwEfp6fVq5wosJsY1mt4lLfYdVew=
110-
go.opentelemetry.io/otel/trace v1.39.0 h1:2d2vfpEDmCJ5zVYz7ijaJdOF59xLomrvj7bjt6/qCJI=
111-
go.opentelemetry.io/otel/trace v1.39.0/go.mod h1:88w4/PnZSazkGzz/w84VHpQafiU4EtqqlVdxWy+rNOA=
104+
go.opentelemetry.io/otel v1.43.0 h1:mYIM03dnh5zfN7HautFE4ieIig9amkNANT+xcVxAj9I=
105+
go.opentelemetry.io/otel v1.43.0/go.mod h1:JuG+u74mvjvcm8vj8pI5XiHy1zDeoCS2LB1spIq7Ay0=
106+
go.opentelemetry.io/otel/metric v1.43.0 h1:d7638QeInOnuwOONPp4JAOGfbCEpYb+K6DVWvdxGzgM=
107+
go.opentelemetry.io/otel/metric v1.43.0/go.mod h1:RDnPtIxvqlgO8GRW18W6Z/4P462ldprJtfxHxyKd2PY=
108+
go.opentelemetry.io/otel/sdk v1.43.0 h1:pi5mE86i5rTeLXqoF/hhiBtUNcrAGHLKQdhg4h4V9Dg=
109+
go.opentelemetry.io/otel/sdk v1.43.0/go.mod h1:P+IkVU3iWukmiit/Yf9AWvpyRDlUeBaRg6Y+C58QHzg=
110+
go.opentelemetry.io/otel/sdk/metric v1.43.0 h1:S88dyqXjJkuBNLeMcVPRFXpRw2fuwdvfCGLEo89fDkw=
111+
go.opentelemetry.io/otel/sdk/metric v1.43.0/go.mod h1:C/RJtwSEJ5hzTiUz5pXF1kILHStzb9zFlIEe85bhj6A=
112+
go.opentelemetry.io/otel/trace v1.43.0 h1:BkNrHpup+4k4w+ZZ86CZoHHEkohws8AY+WTX09nk+3A=
113+
go.opentelemetry.io/otel/trace v1.43.0/go.mod h1:/QJhyVBUUswCphDVxq+8mld+AvhXZLhe+8WVFxiFff0=
112114
go.uber.org/mock v0.6.0 h1:hyF9dfmbgIX5EfOdasqLsWD6xqpNZlXblLB/Dbnwv3Y=
113115
go.uber.org/mock v0.6.0/go.mod h1:KiVJ4BqZJaMj4svdfmHM0AUx4NJYO8ZNpPnZn1Z+BBU=
114-
golang.org/x/arch v0.23.0 h1:lKF64A2jF6Zd8L0knGltUnegD62JMFBiCPBmQpToHhg=
115-
golang.org/x/arch v0.23.0/go.mod h1:dNHoOeKiyja7GTvF9NJS1l3Z2yntpQNzgrjh1cU103A=
116-
golang.org/x/crypto v0.47.0 h1:V6e3FRj+n4dbpw86FJ8Fv7XVOql7TEwpHapKoMJ/GO8=
117-
golang.org/x/crypto v0.47.0/go.mod h1:ff3Y9VzzKbwSSEzWqJsJVBnWmRwRSHt/6Op5n9bQc4A=
118-
golang.org/x/net v0.49.0 h1:eeHFmOGUTtaaPSGNmjBKpbng9MulQsJURQUAfUwY++o=
119-
golang.org/x/net v0.49.0/go.mod h1:/ysNB2EvaqvesRkuLAyjI1ycPZlQHM3q01F02UY/MV8=
120-
golang.org/x/sync v0.19.0 h1:vV+1eWNmZ5geRlYjzm2adRgW2/mcpevXNg50YZtPCE4=
121-
golang.org/x/sync v0.19.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI=
116+
golang.org/x/arch v0.24.0 h1:qlJ3M9upxvFfwRM51tTg3Yl+8CP9vCC1E7vlFpgv99Y=
117+
golang.org/x/arch v0.24.0/go.mod h1:dNHoOeKiyja7GTvF9NJS1l3Z2yntpQNzgrjh1cU103A=
118+
golang.org/x/crypto v0.49.0 h1:+Ng2ULVvLHnJ/ZFEq4KdcDd/cfjrrjjNSXNzxg0Y4U4=
119+
golang.org/x/crypto v0.49.0/go.mod h1:ErX4dUh2UM+CFYiXZRTcMpEcN8b/1gxEuv3nODoYtCA=
120+
golang.org/x/net v0.52.0 h1:He/TN1l0e4mmR3QqHMT2Xab3Aj3L9qjbhRm78/6jrW0=
121+
golang.org/x/net v0.52.0/go.mod h1:R1MAz7uMZxVMualyPXb+VaqGSa3LIaUqk0eEt3w36Sw=
122+
golang.org/x/sync v0.20.0 h1:e0PTpb7pjO8GAtTs2dQ6jYa5BWYlMuX047Dco/pItO4=
123+
golang.org/x/sync v0.20.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
122124
golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
123-
golang.org/x/sys v0.40.0 h1:DBZZqJ2Rkml6QMQsZywtnjnnGvHza6BTfYFWY9kjEWQ=
124-
golang.org/x/sys v0.40.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
125-
golang.org/x/text v0.33.0 h1:B3njUFyqtHDUI5jMn1YIr5B0IE2U0qck04r6d4KPAxE=
126-
golang.org/x/text v0.33.0/go.mod h1:LuMebE6+rBincTi9+xWTY8TztLzKHc/9C1uBCG27+q8=
127-
gonum.org/v1/gonum v0.16.0 h1:5+ul4Swaf3ESvrOnidPp4GZbzf0mxVQpDCYUQE7OJfk=
128-
gonum.org/v1/gonum v0.16.0/go.mod h1:fef3am4MQ93R2HHpKnLk4/Tbh/s0+wqD5nfa6Pnwy4E=
129-
google.golang.org/genproto/googleapis/rpc v0.0.0-20260203192932-546029d2fa20 h1:Jr5R2J6F6qWyzINc+4AM8t5pfUz6beZpHp678GNrMbE=
130-
google.golang.org/genproto/googleapis/rpc v0.0.0-20260203192932-546029d2fa20/go.mod h1:j9x/tPzZkyxcgEFkiKEEGxfvyumM01BEtsW8xzOahRQ=
131-
google.golang.org/grpc v1.79.1 h1:zGhSi45ODB9/p3VAawt9a+O/MULLl9dpizzNNpq7flY=
132-
google.golang.org/grpc v1.79.1/go.mod h1:KmT0Kjez+0dde/v2j9vzwoAScgEPx/Bw1CYChhHLrHQ=
125+
golang.org/x/sys v0.42.0 h1:omrd2nAlyT5ESRdCLYdm3+fMfNFE/+Rf4bDIQImRJeo=
126+
golang.org/x/sys v0.42.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
127+
golang.org/x/text v0.35.0 h1:JOVx6vVDFokkpaq1AEptVzLTpDe9KGpj5tR4/X+ybL8=
128+
golang.org/x/text v0.35.0/go.mod h1:khi/HExzZJ2pGnjenulevKNX1W67CUy0AsXcNubPGCA=
129+
gonum.org/v1/gonum v0.17.0 h1:VbpOemQlsSMrYmn7T2OUvQ4dqxQXU+ouZFQsZOx50z4=
130+
gonum.org/v1/gonum v0.17.0/go.mod h1:El3tOrEuMpv2UdMrbNlKEh9vd86bmQ6vqIcDwxEOc1E=
131+
google.golang.org/genproto/googleapis/rpc v0.0.0-20260226221140-a57be14db171 h1:ggcbiqK8WWh6l1dnltU4BgWGIGo+EVYxCaAPih/zQXQ=
132+
google.golang.org/genproto/googleapis/rpc v0.0.0-20260226221140-a57be14db171/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=
133+
google.golang.org/grpc v1.81.1 h1:VnnIIZ88UzOOKLukQi+ImGz8O1Wdp8nAGGnvOfEIWQQ=
134+
google.golang.org/grpc v1.81.1/go.mod h1:xGH9GfzOyMTGIOXBJmXt+BX/V0kcdQbdcuwQ/zNw42I=
133135
google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE=
134136
google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
135137
gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=

‎agent/collector/auditd/auditd_linux.go‎

Lines changed: 27 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@ package auditd
55

66
import (
77
"context"
8+
"errors"
89
"os"
910
"sync"
1011
"time"
@@ -35,9 +36,10 @@ func (a *AuditdCollector) Name() string {
3536

3637
// Start begins collecting audit events and sending them to the queue
3738
func (a *AuditdCollector) Start(ctx context.Context, queue chan *plugins.Log) {
38-
// Preflight check for audit capability
3939
if err := checkAuditCapability(); err != nil {
40-
utils.Logger.ErrorF("auditd: preflight check failed: %v", err)
40+
if !errors.Is(err, ErrAuditUnavailable) {
41+
utils.Logger.ErrorF("auditd: preflight check failed: %v", err)
42+
}
4143
return
4244
}
4345

@@ -59,9 +61,15 @@ func (a *AuditdCollector) Start(ctx context.Context, queue chan *plugins.Log) {
5961

6062
exitCode := a.runAuditClient(ctx, host, queue)
6163

62-
if exitCode == 0 {
64+
switch exitCode {
65+
case 0:
6366
utils.Logger.Info("auditd client exited normally")
64-
} else {
67+
case auditdExitPermanent:
68+
// Environment cannot run auditd (e.g. missing CAP_AUDIT_*, kernel
69+
// audit disabled). Retrying will never succeed — exit silently.
70+
utils.Logger.Info("auditd collector disabled: audit subsystem not accessible in this environment")
71+
return
72+
default:
6573
utils.Logger.ErrorF("auditd client exited with code %d, restarting in %v", exitCode, restartDelay)
6674
}
6775

@@ -79,35 +87,40 @@ func (a *AuditdCollector) Start(ctx context.Context, queue chan *plugins.Log) {
7987
}
8088
}
8189

90+
// auditdExitPermanent signals that the collector cannot run in this
91+
// environment and must not be retried.
92+
const auditdExitPermanent = -2
93+
8294
// runAuditClient creates the audit client and runs the receive loop
8395
func (a *AuditdCollector) runAuditClient(ctx context.Context, host string, queue chan *plugins.Log) int {
8496
a.mu.Lock()
8597
clientCtx, cancel := context.WithCancel(ctx)
8698
a.cancel = cancel
8799

88-
// Attempt to set kernel backlog limit to prevent event loss under high load.
89-
// This requires CAP_AUDIT_CONTROL; log warning if it fails but continue.
100+
// Attempt to set kernel backlog limit and wait time. Both are best-effort
101+
// tuning that require CAP_AUDIT_CONTROL — if they fail we just continue
102+
// with kernel defaults, so log at Info level to avoid noise on restricted
103+
// hosts (e.g. containers without audit capabilities).
90104
if err := setKernelBacklogLimit(kernelBacklogLimit); err != nil {
91-
utils.Logger.ErrorF("auditd: failed to set kernel backlog limit to %d: %v (continuing with default)", kernelBacklogLimit, err)
105+
utils.Logger.Info("auditd: could not set kernel backlog limit (%v), using default", err)
92106
} else {
93107
utils.Logger.Info("auditd: kernel backlog limit set to %d", kernelBacklogLimit)
94108
}
95109

96-
// Set backlog wait time to 0 to prevent audited processes from blocking
97-
// when the audit backlog queue is full. The kernel will drop events instead.
98-
// This is the "kernel" backpressure mitigation strategy from Elastic Auditbeat.
99110
if err := setBacklogWaitTime(0); err != nil {
100-
utils.Logger.ErrorF("auditd: failed to set backlog wait time to 0: %v (continuing)", err)
111+
utils.Logger.Info("auditd: could not set backlog wait time (%v), using default", err)
101112
} else {
102113
utils.Logger.Info("auditd: backlog wait time set to 0 (non-blocking mode)")
103114
}
104115

105-
// Create multicast audit client
116+
// Create multicast audit client. Failure here (typically EPERM when the
117+
// agent lacks CAP_AUDIT_READ) is permanent for the current process — the
118+
// outer Start loop treats auditdExitPermanent as a no-retry condition.
106119
client, err := newAuditClient()
107120
if err != nil {
108121
a.mu.Unlock()
109-
utils.Logger.ErrorF("auditd: error creating audit client: %v", err)
110-
return -1
122+
utils.Logger.Info("auditd: cannot open audit netlink socket (%v); collector will not run", err)
123+
return auditdExitPermanent
111124
}
112125
a.client = client
113126

‎agent/collector/auditd/capabilities.go‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -4,35 +4,35 @@
44
package auditd
55

66
import (
7+
"errors"
78
"os/exec"
89
"strings"
910

1011
"github.com/utmstack/UTMStack/agent/utils"
1112
)
1213

14+
var ErrAuditUnavailable = errors.New("audit subsystem unavailable in this environment")
15+
1316
// checkAuditCapability checks if the audit system is available and enabled.
1417
// Uses auditctl -s to verify audit status since /proc/sys/kernel/auditing
1518
// doesn't exist on all kernel versions.
1619
func checkAuditCapability() error {
17-
// Check if auditctl exists
1820
auditctlPath, err := exec.LookPath("auditctl")
1921
if err != nil {
20-
utils.Logger.ErrorF("auditd: auditctl not found in PATH: %v", err)
21-
return err
22+
utils.Logger.Info("auditd: auditctl not found in PATH, collector will not start")
23+
return ErrAuditUnavailable
2224
}
2325

24-
// Run auditctl -s to check audit status
2526
cmd := exec.Command(auditctlPath, "-s")
2627
output, err := cmd.Output()
2728
if err != nil {
28-
utils.Logger.ErrorF("auditd: failed to run auditctl -s: %v", err)
29-
return err
29+
utils.Logger.Info("auditd: failed to run auditctl -s (%v), collector will not start", err)
30+
return ErrAuditUnavailable
3031
}
3132

32-
// Check if enabled=1 in output
3333
if !strings.Contains(string(output), "enabled 1") && !strings.Contains(string(output), "enabled=1") {
3434
utils.Logger.Info("auditd: kernel auditing is disabled (enabled != 1), collector will not start")
35-
return nil
35+
return ErrAuditUnavailable
3636
}
3737

3838
utils.Logger.Info("auditd: audit system is enabled and ready")

‎agent/dependency/auditd_linux.go‎

Lines changed: 9 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -98,45 +98,40 @@ func configureAuditd() error {
9898

9999
utils.Logger.Info("Detected distro: ID=%s, IDLike=%s, PackageManager=%s", distro.ID, distro.IDLike, distro.PackageManager)
100100

101-
// Install auditd if not already installed
102101
if !isAuditdInstalled() {
103102
utils.Logger.Info("Installing auditd package...")
104103
if err := installAuditd(distro); err != nil {
105-
utils.Logger.ErrorF("Failed to install auditd: %v", err)
106-
return nil // Non-critical, don't fail the agent
104+
utils.Logger.Info("auditd setup skipped: package install failed (%v)", err)
105+
return nil
107106
}
108107
utils.Logger.Info("auditd package installed successfully")
109108
} else {
110109
utils.Logger.Info("auditd is already installed")
111110
}
112111

113-
// Pre-flight check: can we modify audit configuration?
114112
if canConfigure, reason := canConfigureAuditd(); !canConfigure {
115113
utils.Logger.Info("auditd rule deployment skipped: %s", reason)
116-
return nil // Non-critical, don't fail the agent
114+
return nil
117115
}
118116

119-
// Deploy audit rules
120117
utils.Logger.Info("Deploying UTMStack audit rules...")
121118
if err := deployRules(); err != nil {
122-
utils.Logger.ErrorF("Failed to deploy audit rules: %v", err)
123-
return nil // Non-critical, don't fail the agent
119+
utils.Logger.Info("auditd setup skipped: rule deployment failed (%v)", err)
120+
return nil
124121
}
125122
utils.Logger.Info("UTMStack audit rules deployed successfully")
126123

127-
// Start and enable auditd service
128124
utils.Logger.Info("Starting auditd service...")
129125
if err := startAuditd(); err != nil {
130-
utils.Logger.ErrorF("Failed to start auditd service: %v", err)
131-
return nil // Non-critical, don't fail the agent
126+
utils.Logger.Info("auditd setup skipped: service start failed (%v)", err)
127+
return nil
132128
}
133129
utils.Logger.Info("auditd service started and enabled")
134130

135-
// Reload rules
136131
utils.Logger.Info("Reloading audit rules...")
137132
if err := reloadRules(); err != nil {
138-
utils.Logger.ErrorF("Failed to reload audit rules: %v", err)
139-
return nil // Non-critical, don't fail the agent
133+
utils.Logger.Info("auditd setup skipped: rule reload failed (%v)", err)
134+
return nil
140135
}
141136
utils.Logger.Info("Audit rules reloaded successfully")
142137

‎agent/go.mod‎

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -6,18 +6,18 @@ require (
66
github.com/AtlasInsideCorp/AtlasInsideAES v1.0.0
77
github.com/elastic/go-libaudit/v2 v2.6.2
88
github.com/elastic/go-sysinfo v1.15.4
9-
github.com/fsnotify/fsnotify v1.9.0
9+
github.com/fsnotify/fsnotify v1.10.1
1010
github.com/glebarez/sqlite v1.11.0
1111
github.com/google/uuid v1.6.0
1212
github.com/kardianos/service v1.2.4
1313
github.com/netsampler/goflow2 v1.3.7
1414
github.com/spf13/cobra v1.10.2
1515
github.com/tehmaze/netflow v0.0.0-20240303214733-8c13bb004068
16-
github.com/threatwinds/go-sdk v1.1.14
16+
github.com/threatwinds/go-sdk v1.1.21
1717
github.com/threatwinds/logger v1.2.3
1818
github.com/utmstack/UTMStack/shared v0.0.0
19-
golang.org/x/sys v0.41.0
20-
google.golang.org/grpc v1.79.1
19+
golang.org/x/sys v0.44.0
20+
google.golang.org/grpc v1.81.1
2121
google.golang.org/protobuf v1.36.11
2222
gorm.io/gorm v1.31.1
2323
)
@@ -68,13 +68,13 @@ require (
6868
github.com/twitchyliquid64/golang-asm v0.15.1 // indirect
6969
github.com/ugorji/go/codec v1.3.1 // indirect
7070
go.yaml.in/yaml/v2 v2.4.3 // indirect
71-
golang.org/x/arch v0.23.0 // indirect
72-
golang.org/x/crypto v0.47.0 // indirect
71+
golang.org/x/arch v0.24.0 // indirect
72+
golang.org/x/crypto v0.49.0 // indirect
7373
golang.org/x/exp v0.0.0-20260112195511-716be5621a96 // indirect
74-
golang.org/x/net v0.49.0 // indirect
75-
golang.org/x/text v0.33.0 // indirect
76-
google.golang.org/genproto/googleapis/api v0.0.0-20260203192932-546029d2fa20 // indirect
77-
google.golang.org/genproto/googleapis/rpc v0.0.0-20260203192932-546029d2fa20 // indirect
74+
golang.org/x/net v0.52.0 // indirect
75+
golang.org/x/text v0.35.0 // indirect
76+
google.golang.org/genproto/googleapis/api v0.0.0-20260226221140-a57be14db171 // indirect
77+
google.golang.org/genproto/googleapis/rpc v0.0.0-20260226221140-a57be14db171 // indirect
7878
gopkg.in/natefinch/lumberjack.v2 v2.2.1 // indirect
7979
gopkg.in/yaml.v3 v3.0.1 // indirect
8080
howett.net/plist v1.0.1 // indirect

0 commit comments

Comments
 (0)