Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Elastic Agent] The log input should report itself as Degraded when it encounters a permissions error #39733

Closed
Tracked by #39604
cmacknz opened this issue May 24, 2024 · 1 comment · Fixed by #40075
Assignees
Labels
Team:Elastic-Agent-Data-Plane Label for the Agent Data Plane team

Comments

@cmacknz
Copy link
Member

cmacknz commented May 24, 2024

Today when the log input does not have permission to open a file, it logs an error.

{"log.level":"error","@timestamp":"2024-05-06T06:52:38.843Z","message":"Harvester could not be started on new file: /var/log/system.log, Err: error setting up harvester: Harvester setup failed. Unexpected file opening error: Failed opening /var/log/system.log: open /var/log/system.log: permission denied","component":{"binary":"filebeat","dataset":"elastic_agent.filebeat","id":"log-default","type":"log"},"log":{"source":"log-default"},"finished":false,"ecs.version":"1.6.0","log.origin":{"file.line":561,"file.name":"log/input.go","function":"github.com/elastic/beats/v7/filebeat/input/log.(*Input).scan"},"service.name":"filebeat","state_id":"native::9418910-16777229","log.logger":"input","input_id":"476b19f2-632a-4647-8700-78e244554690","source_file":"/var/log/system.log","os_id":"9418910-16777229","ecs.version":"1.6.0"}

When the log input is run as part of the system integration installed in an unprivileged agent, this can lead to missing data with no obvious signal to the user in the output of elastic-agent status or in the Fleet UI. This is a poor user experience as users will install the system integration and data will be missing with no obvious root cause.

Modify the log input to set itself as Degraded using the Elastic Agent control protocol when it encounters a permissions error attempting to read a file. Support for reporting status using the control protocol was added in #39209 using the CEL input as a reference implementation.

@cmacknz cmacknz added the Team:Elastic-Agent-Data-Plane Label for the Agent Data Plane team label May 24, 2024
@elasticmachine
Copy link
Collaborator

Pinging @elastic/elastic-agent-data-plane (Team:Elastic-Agent-Data-Plane)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Team:Elastic-Agent-Data-Plane Label for the Agent Data Plane team
Projects
None yet
Development

Successfully merging a pull request may close this issue.

3 participants