Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Cherry-pick #19945 to 7.9: Packetbeat process monitor: Ignore missing /proc/net/tcp6 #20014

Merged
merged 1 commit into from
Jul 20, 2020

Conversation

adriansr
Copy link
Contributor

@adriansr adriansr commented Jul 17, 2020

Cherry-pick of PR #19945 to 7.9 branch. Original message:

What does this PR do?

This makes Packetbeat's process monitor to continue execution when /proc/net/tcp6 is missing (ipv6 disabled in kernel).

Why is it important?

The process monitor feature was not working when ipv6 was disabled.

Checklist

  • My code follows the style guidelines of this project
  • I have commented my code, particularly in hard-to-understand areas
  • I have made corresponding changes to the documentation
  • I have made corresponding change to the default configuration files
  • I have added tests that prove my fix is effective or that my feature works
  • I have added an entry in CHANGELOG.next.asciidoc or CHANGELOG-developer.next.asciidoc.

How to test this PR locally

  • Boot kernel with ipv6.disable=1
  • Run packetbeat with -E packetbeat.procs.enabled=true

Related issues

Closes #19941

Logs

Errors before this fix:

2020-07-15T10:01:30.006Z	ERROR	procs/procs_linux.go:73	GetLocalPortToPIDMapping: parsing '/proc/net/tcp6': open /proc/net/tcp6: no such file or directory
2020-07-15T10:01:30.006Z	ERROR	procs/procs.go:224	unable to list local ports: open /proc/net/tcp6: no such file or directory

Warning after this fix (shown only once):

2020-07-16T12:04:20.802Z	WARN	procs/procs_linux.go:80	No IPv6 socket info reported by the kernel. Process monitor won't enrich IPv6 events

)

This makes Packetbeat's process monitor to continue execution when
/proc/net/tcp6 is missing (ipv6 disabled in kernel).

Closes elastic#19941

(cherry picked from commit 4ce680c)
@elasticmachine
Copy link
Collaborator

Pinging @elastic/siem (Team:SIEM)

@botelastic botelastic bot added needs_team Indicates that the issue/PR needs a Team:* label and removed needs_team Indicates that the issue/PR needs a Team:* label labels Jul 17, 2020
@adriansr adriansr merged commit a3bb99d into elastic:7.9 Jul 20, 2020
@zube zube bot removed the [zube]: Done label Oct 18, 2020
leweafan pushed a commit to leweafan/beats that referenced this pull request Apr 28, 2023
) (elastic#20014)

This makes Packetbeat's process monitor to continue execution when
/proc/net/tcp6 is missing (ipv6 disabled in kernel).

Closes elastic#19941

(cherry picked from commit 95166b9)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants