packetbeat/beater: make sure Npcap installation runs before interfaces are needed in all cases (#30438)

efd6 · web-flow · commit 2a181e07a13c · 2022-02-19T06:48:10.000+10:30
This is a second attempt to ensure that Npcap is correctly installed; running
packetbeat managed by elastic-agent appears to have a different code path to
that when running vanilla packetbeat and does not execute Create in time (at
all?) to have the installer run. So move the installNpcap call to the earliest
time we have all the needed information to ensure that the library is installed
by the time that it is needed.
diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc
@@ -138,7 +138,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...main[Check the HEAD dif
 
 *Packetbeat*
 
-- Add automated OEM Npcap installation handling. {pull}29112[29112] {pull}30396[30396]
+- Add automated OEM Npcap installation handling. {pull}29112[29112] {pull}30438[30438]
 - Add support for capturing TLS random number and OCSP status request details. {issue}29962[29962] {pull}30102[30102]
 
 *Functionbeat*
diff --git a/packetbeat/beater/packetbeat.go b/packetbeat/beater/packetbeat.go
@@ -95,6 +95,12 @@ func New(b *beat.Beat, rawConfig *common.Config) (beat.Beater, error) {
 		return nil, err
 	}
 
+	// Install Npcap if needed.
+	err := installNpcap(b)
+	if err != nil {
+		return nil, err
+	}
+
 	return &packetbeat{
 		config:  rawConfig,
 		factory: factory,
diff --git a/packetbeat/beater/processor.go b/packetbeat/beater/processor.go
@@ -113,12 +113,6 @@ func (p *processorFactory) Create(pipeline beat.PipelineConnector, cfg *common.C
 		return nil, err
 	}
 
-	// Install Npcap if needed.
-	err = installNpcap(p.beat)
-	if err != nil {
-		return nil, err
-	}
-
 	publisher, err := publish.NewTransactionPublisher(
 		p.beat.Info.Name,
 		p.beat.Publisher,
