Skip to content

Commit

Permalink
Packetbeat process monitor: Ignore missing /proc/net/tcp6 (elastic#19945
Browse files Browse the repository at this point in the history
) (elastic#20014)

This makes Packetbeat's process monitor to continue execution when
/proc/net/tcp6 is missing (ipv6 disabled in kernel).

Closes elastic#19941

(cherry picked from commit 95166b9)
  • Loading branch information
adriansr authored Jul 20, 2020
1 parent 50bb482 commit 7ade56b
Show file tree
Hide file tree
Showing 2 changed files with 14 additions and 2 deletions.
1 change: 1 addition & 0 deletions CHANGELOG.next.asciidoc
Original file line number Diff line number Diff line change
Expand Up @@ -330,6 +330,7 @@ field. You can revert this change by configuring tags for the module and omittin
*Packetbeat*

- Enable setting promiscuous mode automatically. {pull}11366[11366]
- Fix process monitoring when ipv6 is disabled under Linux. {issue}19941[19941] {pull}19945[19945]

*Winlogbeat*

Expand Down
15 changes: 13 additions & 2 deletions packetbeat/procs/procs_linux.go
Original file line number Diff line number Diff line change
Expand Up @@ -30,6 +30,7 @@ import (
"path/filepath"
"strconv"
"strings"
"sync"

"github.com/elastic/beats/v7/libbeat/logp"
"github.com/elastic/beats/v7/packetbeat/protos/applayer"
Expand All @@ -51,6 +52,8 @@ var procFiles = map[applayer.Transport]struct {
applayer.TransportTCP: {"/proc/net/tcp", "/proc/net/tcp6"},
}

var warnIPv6Once sync.Once

// GetLocalPortToPIDMapping returns the list of local port numbers and the PID
// that owns them.
func (proc *ProcessesWatcher) GetLocalPortToPIDMapping(transport applayer.Transport) (ports map[endpoint]int, err error) {
Expand All @@ -68,10 +71,18 @@ func (proc *ProcessesWatcher) GetLocalPortToPIDMapping(transport applayer.Transp
logp.Err("GetLocalPortToPIDMapping: parsing '%s': %s", sourceFiles.ipv4, err)
return nil, err
}

ipv6socks, err := socketsFromProc(sourceFiles.ipv6, true)
// Ignore the error when /proc/net/tcp6 doesn't exists (ipv6 disabled).
if err != nil {
logp.Err("GetLocalPortToPIDMapping: parsing '%s': %s", sourceFiles.ipv6, err)
return nil, err
if os.IsNotExist(err) {
warnIPv6Once.Do(func() {
logp.Warn("No IPv6 socket info reported by the kernel. Process monitor won't enrich IPv6 events")
})
} else {
logp.Err("GetLocalPortToPIDMapping: parsing '%s': %s", sourceFiles.ipv6, err)
return nil, err
}
}
socksMap := map[uint64]*socketInfo{}
for _, s := range ipv4socks {
Expand Down

0 comments on commit 7ade56b

Please sign in to comment.