Why does Linux Auditd App filter out root for the user lookup?

[dconnett_splunk]

Hello,

I have been using the Linux Auditd app, which has been great, but I noticed that the learnt_posix_identities  lookup filters out the root user.

[|inputlookup auditd_indices] [|inputlookup auditd_sourcetypes] type="USER_START" acct=* NOT acct=root NOT auid=0 terminal=/dev/tty* OR NOT addr=? | dedup auid | table auid acct | rename auid as _key | rename acct as user | outputlookup append=true learnt_posix_identities

A lot of my syscalls are coming from root and the dashboards display unknown user. I could just manually edit the KV Store to add root, however I wanted to understand why this filter was here to make sure I don't break something.

Regards,

Dave

[doksu]

The root user is the only truly universal user on any Linux machine so it's not in the learnt identities but the static identities lookup (https://github.com/doksu/splunk_auditd/blob/master/TA-linux_auditd/lookups/posix_identities.csv), and they get merged together automatically. Best check your static identities lookup to ensure it has root in it.