Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Avoid packetbeat flooding logs with FindSocketsOfPid errors when on system with short living processes #33793

Closed
arvchristos opened this issue Nov 23, 2022 · 1 comment · Fixed by #33854
Assignees

Comments

@arvchristos
Copy link

arvchristos commented Nov 23, 2022

Describe the enhancement:

Due to the error logging here, on systems running many short living processes, we realized that packetbeat is flooding logs with entries like the following:

{"log.level":"error","@timestamp":"2022-06-09T15:25:57.629+0200","log.origin":{"file.name":"procs/procs_linux.go","file.line":115},"message":"FindSocketsOfPid: open /proc/15404/fd: no such file or directory","service.name":"packetbeat","ecs.version":"1.6.0"}

This happens when packetbeat.procs.enabled: true. There is no way to disable such log messages (while keeping the level to error to still get useful logs). This should not be logged as an error, given that the execution is continuing.

Describe a specific use case for the enhancement or feature:

Process data is added on best effort, given that packetbeat process info is originating from procfs. In case of short living processes, no process data is added considering that by the time this enrichment takes place, the connected procfs directory may not exist.

This type of log entry should be on level warning or info, so as to support best-effort enrichment without flooding the logs.

@botelastic botelastic bot added the needs_team Indicates that the issue/PR needs a Team:* label label Nov 23, 2022
@elasticmachine
Copy link
Collaborator

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

@botelastic botelastic bot removed the needs_team Indicates that the issue/PR needs a Team:* label label Nov 28, 2022
@efd6 efd6 self-assigned this Nov 28, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging a pull request may close this issue.

4 participants