diff --git a/auditbeat/docs/breaking.asciidoc b/auditbeat/docs/breaking.asciidoc deleted file mode 100644 index 418a4138b7a0..000000000000 --- a/auditbeat/docs/breaking.asciidoc +++ /dev/null @@ -1,126 +0,0 @@ -[[auditbeat-breaking-changes]] - -== Breaking changes in 6.2 - -As a general rule, we strive to keep backwards compatibility between minor -versions (e.g. 6.x to 6.y) so you can upgrade without any configuration file -changes, but there are breaking changes between the earlier beta releases and -the 6.2 GA release. - -There are changes that affect both the configuration and the event schema. - -[float] -=== Configuration Changes - -The audit module has been renamed and is now two separate modules: the -<> and the -<>. You must update your -configuration to use these modules. - -The `kernel` metricset has become the <>. - -.Old Config -[source,yaml] ----- -- module: audit - metricsets: ["kernel"] - kernel.resolve_ids: true - kernel.failure_mode: silent - kernel.backlog_limit: 8196 - kernel.rate_limit: 0 - kernel.include_raw_message: false - kernel.include_warnings: false - kernel.audit_rules: | - # Rules ----- - -.New Config -[source,yaml] ----- -- module: auditd - resolve_ids: true - failure_mode: silent - backlog_limit: 8196 - rate_limit: 0 - include_raw_message: false - include_warnings: false - audit_rules: | - # Rules ----- - -The `file` metricset has become the -<>. - -.Old Config -[source,yaml] ----- -- module: audit - metricsets: [file] - file.paths: - - /bin - - /usr/bin - - /sbin - - /usr/sbin - - /etc - file.scan_at_start: true - file.scan_rate_per_sec: 50 MiB - file.max_file_size: 100 MiB - file.hash_types: [sha1] ----- - -.New Config -[source,yaml] ----- -- module: file_integrity - paths: - - /bin - - /usr/bin - - /sbin - - /usr/sbin - - /etc - scan_at_start: true - scan_rate_per_sec: 50 MiB - max_file_size: 100 MiB - hash_types: [sha1] - recursive: false <1> ----- -<1> `recursive` is a new option in 6.2 and is disabled by default. Set the value -to true to watch for changes in all sub-directories. - -[float] -=== Event Schema Changes - -Most field names were changed in 6.2. We wanted to rename the modules and use -common field names for similar data types across all the modules. The table -below provides a summary of the field changes. - -In Kibana you need to <> the latest dashboards -that work with the new event format. The new dashboards will not work with data -produced by older versions of Auditbeat. - -.Renamed Fields in 6.2 -[frame="topbot",options="header"] -|====================== -|Old Field|New Field -|`metricset.module` |`event.module` -|`metricset.name` |_Removed_ -|`audit.kernel.action` |`event.action` -|`audit.kernel.category` |`event.category` -|`audit.kernel.record_type`|`event.type` -|`audit.kernel.key` |`tags` -|`audit.kernel.actor.attrs`|`user` -|`audit.kernel.actor` |`auditd.summary.actor` -|`audit.kernel.thing` |`auditd.summary.object` -|`audit.kernel.how` |`auditd.summary.how` -|`audit.kernel.socket` |`auditd.data.socket`, `source`, `destination` -footnote:[Based on the syscall type either the `source` or `destination` may -also be populated.] -|`audit.kernel.data.*` |`process.*` footnote:[Fields related to a process -will be moved under the `process` namespace.] -|`audit.kernel.data.*` |`file.*` footnote:[Fields related to a file will be -moved under the `file` namespace.] -|`audit.kernel.data` |`auditd.data` -|`audit.file.action` |`event.action` -|`audit.file.hash` |`hash` -|`audit.file` |`file` -|====================== diff --git a/auditbeat/docs/index.asciidoc b/auditbeat/docs/index.asciidoc index 06b08db3c25c..9dbbc1d1c408 100644 --- a/auditbeat/docs/index.asciidoc +++ b/auditbeat/docs/index.asciidoc @@ -29,10 +29,10 @@ include::./getting-started.asciidoc[] include::{libbeat-dir}/docs/repositories.asciidoc[] -include::./breaking.asciidoc[] - include::./setting-up-running.asciidoc[] +include::./upgrading.asciidoc[] + include::./configuring-howto.asciidoc[] include::./modules.asciidoc[] diff --git a/auditbeat/docs/upgrading.asciidoc b/auditbeat/docs/upgrading.asciidoc new file mode 100644 index 000000000000..b054c12afa2f --- /dev/null +++ b/auditbeat/docs/upgrading.asciidoc @@ -0,0 +1,7 @@ +[[upgrading-auditbeat]] +== Upgrading Auditbeat + +For information about upgrading to a new version, see the following topics in the _Beats Platform Reference_: + +* {beats-ref}/breaking-changes.html[Breaking Changes] +* {beats-ref}/upgrading.html[Upgrading] diff --git a/libbeat/docs/breaking.asciidoc b/libbeat/docs/breaking.asciidoc index f31aa4e0a961..0b5f5962eaef 100644 --- a/libbeat/docs/breaking.asciidoc +++ b/libbeat/docs/breaking.asciidoc @@ -16,7 +16,6 @@ See the following topics for a description of breaking changes: * <> * <> * <> -* {auditbeat-ref}/auditbeat-breaking-changes.html[Breaking changes in Auditbeat 6.2] [[breaking-changes-7.0]]