Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[8.13](backport #39362) [Auditbeat/FIM/fsnotify]: prevent losing events for recursive mode on OS X #39375

Merged
merged 1 commit into from
May 2, 2024

Conversation

mergify[bot]
Copy link
Contributor

@mergify mergify bot commented May 2, 2024

Proposed commit message

This PR prevents FIM from losing events for recursive mode on Mac OS X even when the watchFile of the root dir, added to be monitored, returns an error by always walking the dir. Specifically, this discrepancy, between Linux and OS X oses, is due to the fact that in the latter the underlying library, namely fsnotify, when you add a watch of a directory it walks the directory and adds the respective sub-dir watchers. If any of these fail, e.g. with EACCESS, it returns an error. However, auditbeat's wrapper of this library emits created events by walking the directory. So, in order not to lose any events we need to guarantee that we won't interrupt this flow - we will always walk the directory - and accumulate any errors during this process which we will return only at the end.

Checklist

  • My code follows the style guidelines of this project
  • I have commented my code, particularly in hard-to-understand areas
  • I have made corresponding changes to the documentation
  • I have made corresponding change to the default configuration files
  • I have added tests that prove my fix is effective or that my feature works
  • I have added an entry in CHANGELOG.next.asciidoc or CHANGELOG-developer.next.asciidoc.

Author's Checklist

N/A

How to test this PR locally

Already tested here

Related issues

Use cases

N/A

Screenshots

N/A

Logs

N/A


This is an automatic backport of pull request #39362 done by Mergify.

… OS X (#39362)

* fix(auditbeat/fim/fsnotify): do not return error immediately as this causes losing events on mac

* doc: update CHANGELOG.next.asciidoc

(cherry picked from commit bbf8746)
@mergify mergify bot requested a review from a team as a code owner May 2, 2024 14:55
@mergify mergify bot added the backport label May 2, 2024
@botelastic botelastic bot added the needs_team Indicates that the issue/PR needs a Team:* label label May 2, 2024
@botelastic
Copy link

botelastic bot commented May 2, 2024

This pull request doesn't have a Team:<team> label.

@elasticmachine
Copy link
Collaborator

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS
Pipeline View Test View Changes Artifacts preview preview

Expand to view the summary

Build stats

  • Duration: 44 min 46 sec

❕ Flaky test report

No test was executed to be analysed.

🤖 GitHub comments

Expand to view the GitHub comments

To re-run your PR in the CI, just comment with:

  • /test : Re-trigger the build.

  • /package : Generate the packages and run the E2E tests.

  • /beats-tester : Run the installation tests with beats-tester.

  • run elasticsearch-ci/docs : Re-trigger the docs validation. (use unformatted text in the comment!)

@pkoutsovasilis pkoutsovasilis merged commit e2ede3a into 8.13 May 2, 2024
33 checks passed
@pkoutsovasilis pkoutsovasilis deleted the mergify/bp/8.13/pr-39362 branch May 2, 2024 17:11
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
backport needs_team Indicates that the issue/PR needs a Team:* label
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants