diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc index c7017c4c5177..7de65f9818cd 100644 --- a/CHANGELOG.next.asciidoc +++ b/CHANGELOG.next.asciidoc @@ -34,6 +34,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d *Auditbeat* +- Fix documentation regarding socket type selection. {issue}37174[37174] {pull}37175[37175] *Filebeat* diff --git a/auditbeat/docs/modules/auditd.asciidoc b/auditbeat/docs/modules/auditd.asciidoc index e913160d9cbb..999b1371abad 100644 --- a/auditbeat/docs/modules/auditd.asciidoc +++ b/auditbeat/docs/modules/auditd.asciidoc @@ -153,8 +153,7 @@ stopped (e.g. stop `auditd`). `multicast` can be used in kernel versions 3.16 and newer. By using `multicast` {beatname_uc} will receive an audit event broadcast that is not exclusive to a a single process. This is ideal for situations where `auditd` is running and -managing the rules. If `multicast` is specified, but the kernel version is less -than 3.16 {beatname_uc} will automatically revert to `unicast`. +managing the rules. + By default {beatname_uc} will use `multicast` if the kernel version is 3.16 or newer and no rules have been defined. Otherwise `unicast` will be used. diff --git a/auditbeat/module/auditd/_meta/docs.asciidoc b/auditbeat/module/auditd/_meta/docs.asciidoc index 4585b7179ff9..72249067ab62 100644 --- a/auditbeat/module/auditd/_meta/docs.asciidoc +++ b/auditbeat/module/auditd/_meta/docs.asciidoc @@ -146,8 +146,7 @@ stopped (e.g. stop `auditd`). `multicast` can be used in kernel versions 3.16 and newer. By using `multicast` {beatname_uc} will receive an audit event broadcast that is not exclusive to a a single process. This is ideal for situations where `auditd` is running and -managing the rules. If `multicast` is specified, but the kernel version is less -than 3.16 {beatname_uc} will automatically revert to `unicast`. +managing the rules. + By default {beatname_uc} will use `multicast` if the kernel version is 3.16 or newer and no rules have been defined. Otherwise `unicast` will be used.