Skip to content

Osquerybeat: Fix restart flags after previously bad config#28827

Merged
aleksmaus merged 1 commit intoelastic:masterfrom
aleksmaus:fix/osquery_restart_after_bad_config
Nov 5, 2021
Merged

Osquerybeat: Fix restart flags after previously bad config#28827
aleksmaus merged 1 commit intoelastic:masterfrom
aleksmaus:fix/osquery_restart_after_bad_config

Conversation

@aleksmaus
Copy link
Copy Markdown
Contributor

@aleksmaus aleksmaus commented Nov 4, 2021

What does this PR do?

Fixes the oquery flags update defect.

The issue is reproducible with the following steps:

  1. Apply bad config flag
{
  "options": {
    "disable_events": false,
    "enable_file_events": true
    "enable_ntfs_publisher": true
  }
 }
  1. Osquery stops with error
[elastic_agent.osquerybeat][error] process exited with error: ERROR: unknown command line flag 'enable_ntfs_publisher': exit status 1
  1. Remove enable_ntfs_publisher option.
  2. The osquery uses old flags to (visible in debug log) and fails.

Expected result, the new flags are used and osquery becomes usable (can issue ad-hoc queries for example)

This is a minimal change to fix this for 7.16 next RC is on 11/10.

If I get time before 11/10, will revisit the osquery runner one more time.
If not will leave it for 8.0 to improve.

Why is it important?

Fixes the osquery configuration options update defect in 7.16

Checklist

  • My code follows the style guidelines of this project
  • I have commented my code, particularly in hard-to-understand areas

@botelastic botelastic bot added needs_team Indicates that the issue/PR needs a Team:* label and removed needs_team Indicates that the issue/PR needs a Team:* label labels Nov 4, 2021
james-elastic
james-elastic approved these changes Nov 4, 2021
View reviewed changes
Copy link
Copy Markdown

@james-elastic james-elastic left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

good catch

@elasticmachine
Copy link
Copy Markdown
Contributor

elasticmachine commented Nov 4, 2021

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS
Pipeline View Test View Changes Artifacts preview preview

Expand to view the summary

Build stats

  • Start Time: 2021-11-04T21:13:47.231+0000

  • Duration: 66 min 37 sec

  • Commit: 52e485d

Test stats 🧪

Test Results
Failed 0
Passed 4027
Skipped 0
Total 4027

💚 Flaky test report

Tests succeeded.

🤖 GitHub comments

To re-run your PR in the CI, just comment with:

  • /test : Re-trigger the build.

  • /package : Generate the packages and run the E2E tests.

  • /beats-tester : Run the installation tests with beats-tester.

@aleksmaus aleksmaus merged commit 8d8e387 into elastic:master Nov 5, 2021
@aleksmaus aleksmaus deleted the fix/osquery_restart_after_bad_config branch November 5, 2021 00:25
mergify bot pushed a commit that referenced this pull request Nov 5, 2021
@aleksmaus
Osquerybeat: Fix restart flags after previously bad config (#28827)
f1c3326 
(cherry picked from commit 8d8e387)
@mergify mergify bot mentioned this pull request Nov 5, 2021
Merged
aleksmaus added a commit that referenced this pull request Nov 5, 2021
@mergify @aleksmaus
Osquerybeat: Fix restart flags after previously bad config (#28827) (#…
bf9ba6e 
…28829)

(cherry picked from commit 8d8e387)

Co-authored-by: Aleksandr Maus <aleksandr.maus@elastic.co>
v1v added a commit to v1v/beats that referenced this pull request Nov 8, 2021
@v1v
Merge remote-tracking branch 'upstream/master' into feature/use-arch-…
3afea6c 
…in-the-package-binareis

* upstream/master:
  allows disable pod events enrichment with deployment name (elastic#28521)
  Remove Docker input from Filebeat (elastic#28817)
  [breaking] Make default_field: false the default for all fields (elastic#28596)
  Osquerybeat: Improve osquery client connect code (elastic#28848)
  Add crawler  metrics into the stats metricset for Enterprise Search (elastic#28790)
  Remove the now deprecated appsearch module from metricbeat (elastic#28850)
  Remove Beat generators (elastic#28816)
  chore: upload files to Google Storage when they exist (elastic#28836)
  Revert "chore(ci): disable E2E tests in Beats (elastic#28715)" (elastic#28812)
  Deprecate generating custom Beats (elastic#28814)
  [Metricbeat] upgrade flatbuffers to 1.12.1 (elastic#28094)
  Osquerybeat: Fix restart flags after previously bad config (elastic#28827)
  Force ECS and JSON logging for libbeat/logp (elastic#28573)
  Filebeat: Error on startup for unconfigured module (elastic#28818)
  Deprecate log input in favour of filestream (elastic#28623)
  Fix some spelling mistakes (elastic#28080)
@aleksmaus aleksmaus added the backport-v8.0.0 Automated backport with mergify label Nov 10, 2021
mergify bot pushed a commit that referenced this pull request Nov 10, 2021
@aleksmaus
Osquerybeat: Fix restart flags after previously bad config (#28827)
f83ef17 
(cherry picked from commit 8d8e387)
@mergify mergify bot mentioned this pull request Nov 10, 2021
Merged
aleksmaus added a commit that referenced this pull request Nov 11, 2021
@mergify @aleksmaus
Osquerybeat: Fix restart flags after previously bad config (#28827) (#…
67e1f7d 
…28911)

(cherry picked from commit 8d8e387)

Co-authored-by: Aleksandr Maus <aleksandr.maus@elastic.co>
leweafan pushed a commit to leweafan/beats that referenced this pull request Apr 28, 2023
@v1v
Merge remote-tracking branch 'upstream/master' into feature/use-arch-…
061692b 
…in-the-package-binareis

* upstream/master:
  allows disable pod events enrichment with deployment name (elastic#28521)
  Remove Docker input from Filebeat (elastic#28817)
  [breaking] Make default_field: false the default for all fields (elastic#28596)
  Osquerybeat: Improve osquery client connect code (elastic#28848)
  Add crawler  metrics into the stats metricset for Enterprise Search (elastic#28790)
  Remove the now deprecated appsearch module from metricbeat (elastic#28850)
  Remove Beat generators (elastic#28816)
  chore: upload files to Google Storage when they exist (elastic#28836)
  Revert "chore(ci): disable E2E tests in Beats (elastic#28715)" (elastic#28812)
  Deprecate generating custom Beats (elastic#28814)
  [Metricbeat] upgrade flatbuffers to 1.12.1 (elastic#28094)
  Osquerybeat: Fix restart flags after previously bad config (elastic#28827)
  Force ECS and JSON logging for libbeat/logp (elastic#28573)
  Filebeat: Error on startup for unconfigured module (elastic#28818)
  Deprecate log input in favour of filestream (elastic#28623)
  Fix some spelling mistakes (elastic#28080)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@james-elastic james-elastic james-elastic approved these changes

@scunningham scunningham Awaiting requested review from scunningham

@lykkin lykkin Awaiting requested review from lykkin

Assignees

No one assigned

Labels

backport-v7.16.0 Automated backport with mergify backport-v8.0.0 Automated backport with mergify bug Team:Asset Mgt v7.16.0

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@aleksmaus @elasticmachine @james-elastic