Skip to content

Commit

Permalink
Check if Filebeat log harvester tries to open named pipe (elastic#20450)
Browse files Browse the repository at this point in the history
## What does this PR do?

This PR adds a check before opening a file for harvester Filebeat. If the file is a named pipe, an error is returned and the file is not opened.

## Why is it important?

Previously if someone wanted to open a named pipe without a writer, Filebeat hangs.

## Related issues

Closes elastic#18682
  • Loading branch information
kvch authored and melchiormoulin committed Oct 14, 2020
1 parent 31b481c commit 9e96a54
Show file tree
Hide file tree
Showing 2 changed files with 9 additions and 0 deletions.
1 change: 1 addition & 0 deletions CHANGELOG.next.asciidoc
Original file line number Diff line number Diff line change
Expand Up @@ -507,6 +507,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d
- Add support for additional fields and FirewallMatchEvent type events in CrowdStrike module {pull}20138[20138]
- Add event.ingested for Suricata module {pull}20220[20220]
- Add event.ingested to all Filebeat modules. {pull}20386[20386]
- Return error when log harvester tries to open a named pipe. {issue}18682[18682] {pull}20450[20450]

*Heartbeat*

Expand Down
8 changes: 8 additions & 0 deletions filebeat/input/log/harvester.go
Original file line number Diff line number Diff line change
Expand Up @@ -505,6 +505,14 @@ func (h *Harvester) shouldExportLine(line string) bool {
// is returned and the harvester is closed. The file will be picked up again the next time
// the file system is scanned
func (h *Harvester) openFile() error {
fi, err := os.Stat(h.state.Source)
if err != nil {
return fmt.Errorf("failed to stat source file %s: %v", h.state.Source, err)
}
if fi.Mode()&os.ModeNamedPipe != 0 {
return fmt.Errorf("failed to open file %s, named pipes are not supported", h.state.Source)
}

f, err := file_helper.ReadOpen(h.state.Source)
if err != nil {
return fmt.Errorf("Failed opening %s: %s", h.state.Source, err)
Expand Down

0 comments on commit 9e96a54

Please sign in to comment.