Skip to content

Cherry-pick #20325 to 7.x: system/socket: Allow running multiple instances by grouping kprobes by PID#20353

Merged
adriansr merged 1 commit intoelastic:7.xfrom
adriansr:backport_20325_7.x
Jul 31, 2020
Merged

Cherry-pick #20325 to 7.x: system/socket: Allow running multiple instances by grouping kprobes by PID#20353
adriansr merged 1 commit intoelastic:7.xfrom
adriansr:backport_20325_7.x

Conversation

@adriansr
Copy link
Copy Markdown
Contributor

@adriansr adriansr commented Jul 30, 2020 •
edited by zube bot
Loading

Cherry-pick of PR #20325 to 7.x branch. Original message:

What does this PR do?

This updates the system/socket dataset to group installed kprobes by PID instead of using a generic auditbeat group.

This allows multiple instances of Auditbeat to run with the system/socket dataset enabled (default) avoiding collision of kprobes.

Why is it important?

Currently is not possible to run more than one Auditbeat instance under Linux due to kprobes colliding.

Checklist

I've tested this in Ubuntu 18.04 / kernel 4.15 and it can run multiple instances without trouble.

  • My code follows the style guidelines of this project
  • I have commented my code, particularly in hard-to-understand areas
  • [ ] I have made corresponding changes to the documentation
  • [ ] I have made corresponding change to the default configuration files
  • [ ] I have added tests that prove my fix is effective or that my feature works
  • I have added an entry in CHANGELOG.next.asciidoc or CHANGELOG-developer.next.asciidoc.

Related issues

Closes #20303

@adriansr
Auditbeat: Allow multiple instances by grouping kprobes by PID (elast…
6964158 
…ic#20325)

This updates the system/socket dataset to group installed kprobes by
PID instead of using a generic `auditbeat` group.

This allows multiple instances of Auditbeat to run with the
system/socket dataset enabled (default) avoiding collision of kprobes.

(cherry picked from commit 2abf87f)
@adriansr adriansr requested a review from a team as a code owner July 30, 2020 14:35
@botelastic botelastic bot added the needs_team Indicates that the issue/PR needs a Team:* label label Jul 30, 2020
@elasticmachine
Copy link
Copy Markdown
Contributor

elasticmachine commented Jul 30, 2020

Pinging @elastic/siem (Team:SIEM)

@botelastic botelastic bot removed the needs_team Indicates that the issue/PR needs a Team:* label label Jul 30, 2020
@elasticmachine
Copy link
Copy Markdown
Contributor

elasticmachine commented Jul 30, 2020

💚 Build Succeeded

Pipeline View Test View Changes Artifacts preview

Expand to view the summary

Build stats

  • Build Cause: [Pull request #20353 opened]

  • Start Time: 2020-07-30T14:37:18.286+0000

  • Duration: 55 min 6 sec

Test stats 🧪

Test Results
Failed 0
Passed 230
Skipped 49
Total 279

@adriansr adriansr merged commit 1cacf43 into elastic:7.x Jul 31, 2020
@zube zube bot removed the [zube]: Done label Oct 30, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@andrewkroh andrewkroh andrewkroh approved these changes

Assignees

No one assigned

Labels

backport review

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@adriansr @elasticmachine @andrewkroh