Add backlog_wait_time_actual status field

[maxenglander]

The status field backlog_wait_time_actual is available since
Linux 5.9. It reports the amount of time the kernel has spent
waiting for the backlog to drain with schedule_timeout.

[cla-checker-service]

💚 CLA has been signed

[elasticmachine]

❕ Build Aborted

The PR is not allowed to run in the CI yet

the below badges are clickable and redirect to their specific view in the CI or DOCS

Expand to view the summary

Build stats

• Reason: The PR is not allowed to run in the CI yet

• Start Time: 2021-10-29T13:34:51.668+0000

• Duration: 2 min 9 sec

• Commit: 925b819

[andrewkroh]

That will be a nice metric to have. Thanks @maxenglander

We need to ensure this continues to work with older kernels as well. @efd6 , can you look this over please.

[maxenglander]

@andrewkroh happy to help out with testing. Let me know what kinds of tests you'd like to see. So far I've tested it on the Vagrant image provided in this repo:

vagrant@ubuntu-bionic:~$ uname -r
4.15.0-166-generic
vagrant@ubuntu-bionic:~$ mkdir ~/go/src/github.com/elastic/go-libaudittest
vagrant@ubuntu-bionic:~$ cd ~/go/src/github.com/elastic/go-libaudittest
vagrant@ubuntu-bionic:~/go/src/github.com/elastic/go-libaudittest$ cat <<EOF > main.go
package main

import (
        "fmt"

        libaudit "github.com/elastic/go-libaudit"
)

func main() {
        auditClient, err := libaudit.NewMulticastAuditClient(nil)
        if err != nil {
                fmt.Println("failed to create multicast audit client:", err.Error())
        }

        s, err := auditClient.GetStatus()
        if err != nil {
                fmt.Println("failed to get audit status:", err.Error())
        }

        fmt.Println("Audit status backlog:", s.Backlog)
        fmt.Println("Audit status backlog limit:", s.BacklogLimit)
        fmt.Println("Audit wait time actual:", s.BacklogWaitTimeActual)
}
EOF
vagrant@ubuntu-bionic:~/go/src/github.com/elastic/go-libaudittest$ go get
vagrant@ubuntu-bionic:~/go/src/github.com/elastic/go-libaudittest$ go build .
vagrant@ubuntu-bionic:~/go/src/github.com/elastic/go-libaudittest$ sudo ./go-libaudittest
Audit status backlog: 0
Audit status backlog limit: 64
Audit wait time actual: 0

[andrewkroh]

After looking more closely at the implementation it should be safe to add the new field. Even the godoc on the GetStatus explains this.

[andrewkroh]

/test

[andrewkroh]

@maxenglander Will you please add an entry to the changlelog file in the root of the repo.

[elasticmachine]

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS

Expand to view the summary

Build stats

• Start Time: 2022-01-11T08:20:29.338+0000

• Duration: 3 min 43 sec

• Commit: cfcd379

Test stats 🧪

Test	Results
Failed	0
Passed	365
Skipped	40
Total	405

[efd6]

Apologies for the delay, there is probably a very confused @dan out there.

[andrewkroh]

/test

[efd6]

Failure appears to be due to renaming master => main (jenkins: stderr: fatal: Couldn't find remote ref refs/heads/master).

[andrewkroh]

@Mergifyio rebase

[andrewkroh]

It might not be watching this repo. In any case can you try rebasing this on main to see if that resolves the issue.

[maxenglander]

@andrewkroh I re-committed on top of latest main, and added a comment in the CHANGELOG.

[efd6]

/test

[efd6]

Thanks