Audit logging in Elasticsearch - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

Purpose of Audit Logging in Elasticsearch

What is the main purpose of enabling audit logging in Elasticsearch?

A To monitor cluster health and node resource usage

B To track and record security-related events such as user authentication and access attempts

C To automatically backup data to a remote location

D To improve search query performance by caching frequent queries

💡 Hint

Think about what audit logs are generally used for in security contexts.

Audit logging records security events like user logins, access denials, and configuration changes to help track and investigate security issues.

❓ Configuration

intermediate

Enabling Audit Logging in elasticsearch.yml

Which configuration snippet correctly enables audit logging for all events in Elasticsearch?

A

xpack.security.audit.enabled: true
xpack.security.audit.logfile.events.exclude: ["authentication_failed"]

B

xpack.security.audit.enabled: false
xpack.security.audit.logfile.events.include: ["access_denied"]

C

xpack.security.audit.enabled: true
xpack.security.audit.logfile.events.include: ["authentication_failed"]

D

xpack.security.audit.enabled: true
xpack.security.audit.logfile.events.include: ["*"]

💡 Hint

Look for the setting that enables audit logging and includes all events.

Setting xpack.security.audit.enabled to true turns on audit logging. Including ["*"] means all events are logged.

💻 Command Output

advanced

Output of Audit Log Entry for Failed Login

Given audit logging is enabled, what is the expected key field value in the audit log entry when a user fails to login?

A "event.action": "authentication_failed"

B "event.action": "access_granted"

C "event.action": "cluster_health"

D "event.action": "index_created"

💡 Hint

Think about what action describes a failed login attempt.

The audit log records failed login attempts with the action labeled as authentication_failed.

❓ Troubleshoot

advanced

Troubleshooting Missing Audit Logs

You enabled audit logging in Elasticsearch but no audit logs appear in the log files. Which is the most likely cause?

A The audit log file path is not writable by Elasticsearch process

B Elasticsearch cluster is offline

C Audit logging is enabled but the log level is set too high, filtering out audit events

D The index templates are missing

💡 Hint

Consider file permissions and where logs are written.

If Elasticsearch cannot write to the audit log file path due to permissions, no audit logs will appear despite being enabled.

✅ Best Practice

expert

Best Practice for Managing Audit Log Size

What is a recommended best practice to manage the size and retention of Elasticsearch audit logs in a production environment?

A Manually delete audit log files weekly from the file system

B Disable audit logging during peak hours to reduce log size

C Configure log rotation and retention policies using Elasticsearch's built-in rollover and ILM (Index Lifecycle Management)

D Store audit logs only in memory to avoid disk usage

💡 Hint

Think about automated ways to keep logs manageable over time.

Using rollover and ILM policies automates audit log management, ensuring logs do not grow indefinitely and comply with retention requirements.