Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Metricbeat fails to list all processes when run as a non-privileged user #12301

Closed
adriansr opened this issue May 27, 2019 · 2 comments
Closed

Metricbeat fails to list all processes when run as a non-privileged user #12301

adriansr opened this issue May 27, 2019 · 2 comments
Assignees
@narph @odacremolbap
Labels
bug Metricbeat Metricbeat Team:Integrations Label for the Integrations team :Windows

Comments

@adriansr
Copy link
Contributor

When running Metricbeat under Windows as a regular, non-administrator user, the process / process_summary metricsets won't report processes belonging to other users.

The log is filled with messages like

2019-05-24T13:29:59.487+0200 DEBUG [processes] process/process.go:460 Skip process pid=444: error getting process state for pid=444: getProcCredName failed: OpenProcessToken failed
@adriansr adriansr added bug Metricbeat Metricbeat labels May 27, 2019
adriansr added a commit to adriansr/beats that referenced this issue May 27, 2019
@adriansr
[Metricbeat] Fix system/process* metricsets under Windows
45f7aa0 
This updates vendored elastic/gosigar to v0.10.3, which addresses an
issue when listing processes under a non-privileged Windows user.

For the system/process metricset, only processes belonging to the user
under which Metricbeat is running were reported.

For the system/process_summary metricset, process belonging to other
users were reported as unknown state.

This fix will make Metricbeat able to report all processes, but
information about which users owns those processes will be missing.

Fixes elastic#12301
@adriansr adriansr mentioned this issue May 27, 2019
Closed
@adriansr
Copy link
Contributor Author

@narph I assigned you both after discussing the issue with @odacremolbap

I had a quick fix for this in #12305, however, this PR is causing metricbeat to complain with an error after new code paths are being reached in the Windows+non-admin-user case:

ERROR   instance/metrics.go:92  Error while getting memory usage: error retrieving process stats: cannot find matching process for pid=2456

This will make tests/system/test_system.py:Test.test_process to fail because it doesn't want any ERROR or WARN in the logs.

@narph narph added Team:Integrations Label for the Integrations team [zube]: In Progress labels Jun 4, 2019
@narph narph mentioned this issue Jun 10, 2019
Merged
@narph narph closed this as completed in 08b5c38 Jun 12, 2019
@narph
Copy link
Contributor

narph commented Jun 12, 2019

@adriansr , #12475 has been merged

@zube zube bot added [zube]: Done and removed [zube]: Inbox labels Jun 12, 2019
@zube zube bot reopened this Jun 12, 2019
@zube zube bot added [zube]: Inbox and removed [zube]: Done labels Jun 12, 2019
@zube zube bot closed this as completed Jun 12, 2019
@zube zube bot added [zube]: Done and removed [zube]: Inbox labels Jun 12, 2019
@zube zube bot reopened this Jun 12, 2019
@zube zube bot added [zube]: Inbox and removed [zube]: Done labels Jun 12, 2019
@zube zube bot closed this as completed Jun 12, 2019
@zube zube bot added [zube]: Done and removed [zube]: Inbox labels Jun 12, 2019
@zube zube bot reopened this Jun 12, 2019
@zube zube bot added [zube]: Inbox and removed [zube]: Done labels Jun 12, 2019
@zube zube bot closed this as completed Jun 12, 2019
@zube zube bot added [zube]: Done and removed [zube]: Inbox labels Jun 12, 2019
@zube zube bot reopened this Jun 12, 2019
@zube zube bot added [zube]: Inbox and removed [zube]: Done labels Jun 12, 2019
@zube zube bot closed this as completed Jun 12, 2019
@zube zube bot added [zube]: Done and removed [zube]: Inbox labels Jun 12, 2019
@zube zube bot reopened this Jun 12, 2019
@zube zube bot added [zube]: Inbox and removed [zube]: Done labels Jun 12, 2019
@zube zube bot closed this as completed Jun 12, 2019
@zube zube bot added [zube]: Done and removed [zube]: Inbox labels Jun 12, 2019
@zube zube bot reopened this Jun 12, 2019
@zube zube bot added [zube]: Inbox and removed [zube]: Done labels Jun 12, 2019
@zube zube bot closed this as completed Jun 12, 2019
@zube zube bot added [zube]: Done and removed [zube]: Inbox labels Jun 12, 2019
narph added a commit to narph/beats that referenced this issue Jun 13, 2019
@narph
Continuation of: Adriansr fix mb windows procs elastic#12301 (elastic…
c6ed75e 
…#12475)

* [Metricbeat] Fix system/process* metricsets under Windows

This updates vendored elastic/gosigar to v0.10.3, which addresses an
issue when listing processes under a non-privileged Windows user.

For the system/process metricset, only processes belonging to the user
under which Metricbeat is running were reported.

For the system/process_summary metricset, process belonging to other
users were reported as unknown state.

This fix will make Metricbeat able to report all processes, but
information about which users owns those processes will be missing.

Fixes elastic#12301

* Added test func in order to provide more information on the failing match

* Fix build error

* Removed test func, correcting access rights in sigar_windows file (gosigar pr will follow), test only

* Revert test changes, return debug message for process.getDetails

* Replaced the PR number in the changelog

* Adding selector to log debug message

* Wrong type for pid in debug message

(cherry picked from commit 08b5c38)
@narph narph mentioned this issue Jun 13, 2019
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@narph narph

@odacremolbap odacremolbap

Labels
bug Metricbeat Metricbeat Team:Integrations Label for the Integrations team :Windows
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

[Metricbeat] Fix system/process* metricsets under Windows adriansr/beats
5 participants
@exekias @andresrc @narph @odacremolbap @adriansr