Request: How to filter out "safe" system noise

[anthonysomerset]

not a bug but a request for perhaps documentation/guidance on best ways to filter out clearly system noise - i appreciate this will be different for different systems and people but this is a request for shared knowledge of tweaks users have made to help here

for example i have zabbix, Azure Monitor linux agent (how i ship the logs off to Azure Sentinel) and apt is particularly noisy during updates

i am already doing exclude_spawns_of:cron which also helps - but TBH i think this is a particularly double edged sword because compromises often embed themselves into cron jobs to reinfect

as a seperate FYI also I created a puppet module to properly deploy and enable this on supported systems - https://forge.puppet.com/modules/asomerset/snoopy, this is helping me manage the tool at scale consistently in particular on jumpboxes

code is at https://github.com/anthonysomerset/puppet-snoopy

[bostjan]

Hey @anthonysomerset, thanks for reaching out.

Snoopy was initially created as a "log it all, filter it later during the analysis" solution.

I must confess I don't really have a proposal for a solution to the challenge you've brought up, but having a conversation about it is a good start. If you have a suggestion what an effective "noise" filtering would look like for you, please write it out here. Additionally, I am not averse to having a general filtering implementation and then packaging distro-specific sets of default filters into the binary packages.

One question for your particular case, though - what about exclude_spawns_of:apt?