How to log only unique syscalls in audit log file - Security-Profiles-Operator about security-profiles-operator HOT 8 OPEN

@kecebon9

from security-profiles-operator.

Hey @madantnk, thank you for the report! Hm, so I assume the log enricher is the cause for that and it's enabled in the cluster? Or which kind of logs are you referring to?

from security-profiles-operator.

Hi @saschagrunert Thanks for the response.
It is about the audit log.
How to disable the log enricher?
disabling the log enricher will disable the audit log?
If I disable it will I get the syscall information?
Please advise

from security-profiles-operator.

@madantnk yes you can disable the log enricher: https://github.com/kubernetes-sigs/security-profiles-operator/blob/main/installation-usage.md#using-the-log-enricher

By:

kubectl patch -n security-profiles-operator spod spod -p '{"spec":{"enableLogEnricher": false}}' --type=merge

from security-profiles-operator.

The Kubernetes project currently lacks enough contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue as fresh with /remove-lifecycle stale
• Close this issue with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

from security-profiles-operator.

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue as fresh with /remove-lifecycle rotten
• Close this issue with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle rotten

from security-profiles-operator.