auditbeat/docs/modules: remove incorrect advice in documentation (ela…

…stic#37175) The documentation incorrectly states that socket selection of multicast that cannot be satisfied will fall back to unicast. So remove this claim.
cmacknz · Nov 22, 2023 · 867be3b · 867be3b
1 parent cc39376
commit 867be3b
Show file tree

Hide file tree

Showing 3 changed files with 3 additions and 4 deletions.
diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc
@@ -66,6 +66,7 @@ https://github.com/elastic/beats/compare/v8.8.1\...main[Check the HEAD diff]
 
 *Auditbeat*
 
+- Fix documentation regarding socket type selection. {issue}37174[37174] {pull}37175[37175]
 
 *Filebeat*
 

diff --git a/auditbeat/docs/modules/auditd.asciidoc b/auditbeat/docs/modules/auditd.asciidoc
@@ -154,8 +154,7 @@ stopped (e.g. stop `auditd`).
 `multicast` can be used in kernel versions 3.16 and newer. By using `multicast`
 {beatname_uc} will receive an audit event broadcast that is not exclusive to a
 a single process. This is ideal for situations where `auditd` is running and
-managing the rules. If `multicast` is specified, but the kernel version is less
-than 3.16 {beatname_uc} will automatically revert to `unicast`.
+managing the rules.
 +
 By default {beatname_uc} will use `multicast` if the kernel version is 3.16 or
 newer and no rules have been defined. Otherwise `unicast` will be used.

diff --git a/auditbeat/module/auditd/_meta/docs.asciidoc b/auditbeat/module/auditd/_meta/docs.asciidoc
@@ -147,8 +147,7 @@ stopped (e.g. stop `auditd`).
 `multicast` can be used in kernel versions 3.16 and newer. By using `multicast`
 {beatname_uc} will receive an audit event broadcast that is not exclusive to a
 a single process. This is ideal for situations where `auditd` is running and
-managing the rules. If `multicast` is specified, but the kernel version is less
-than 3.16 {beatname_uc} will automatically revert to `unicast`.
+managing the rules.
 +
 By default {beatname_uc} will use `multicast` if the kernel version is 3.16 or
 newer and no rules have been defined. Otherwise `unicast` will be used.