[auditbeat] fim: implement ebpf backend by mmat11 · Pull Request #37223 · elastic/beats

mmat11 · 2023-11-28T22:46:05Z

Proposed commit message

This PR adds an additional opt-in eBPF backend to the file_integrity module. See related issues for more context.

Checklist

My code follows the style guidelines of this project
I have commented my code, particularly in hard-to-understand areas
I have made corresponding changes to the documentation
I have made corresponding change to the default configuration files
I have added tests that prove my fix is effective or that my feature works
I have added an entry in CHANGELOG.next.asciidoc or CHANGELOG-developer.next.asciidoc.

Author's Checklist

open source https://github.com/elastic/ebpfevents
support setxattrs file modification events
support directories creation events(?)

How to test this PR locally

Enable the eBPF backend in the file_integrity module config by specifying force_backend: ebpf and observe file events after running auditbeat.

Related issues

elasticmachine · 2024-02-02T20:46:09Z

❕ Build Aborted

There is a new build on-going so the previous on-going builds have been aborted.

the below badges are clickable and redirect to their specific view in the CI or DOCS

Expand to view the summary

Build stats

Start Time: 2024-02-02T20:25:10.367+0000
Duration: 21 min 53 sec

Test stats 🧪

Test	Results
Failed	0
Passed	3
Skipped	0
Total	3

Steps errors

Expand to view the steps failures

Show only the first 10 steps failures

`auditbeat-rhel-9-rhel-9 - mage build unitTest`

Took 1 min 6 sec . View more details here
Description: mage build unitTest

`auditbeat-rhel-9-rhel-9 - mage build unitTest`

Took 0 min 2 sec . View more details here
Description: mage build unitTest

`auditbeat-rhel-9-rhel-9 - mage build unitTest`

Took 0 min 2 sec . View more details here
Description: mage build unitTest

`x-pack/auditbeat-build - mage update build test`

Took 1 min 16 sec . View more details here
Description: mage update build test

`x-pack/auditbeat-build - mage update build test`

Took 0 min 5 sec . View more details here
Description: mage update build test

`x-pack/auditbeat-build - mage update build test`

Took 0 min 5 sec . View more details here
Description: mage update build test

`x-pack/auditbeat-rhel-9-rhel-9 - mage build unitTest`

Took 1 min 11 sec . View more details here
Description: mage build unitTest

`x-pack/auditbeat-rhel-9-rhel-9 - mage build unitTest`

Took 0 min 2 sec . View more details here
Description: mage build unitTest

`x-pack/auditbeat-rhel-9-rhel-9 - mage build unitTest`

Took 0 min 2 sec . View more details here
Description: mage build unitTest

`Error signal`

Took 0 min 0 sec . View more details here
Description: Error 'hudson.AbortException: script returned exit code 1'

🤖 GitHub comments

Expand to view the GitHub comments

To re-run your PR in the CI, just comment with:

/test : Re-trigger the build.
/package : Generate the packages and run the E2E tests.
/beats-tester : Run the installation tests with beats-tester.
run elasticsearch-ci/docs : Re-trigger the docs validation. (use unformatted text in the comment!)

elasticmachine · 2024-02-02T20:55:43Z

❕ Build Aborted

Either there was a build timeout or someone aborted the build.

the below badges are clickable and redirect to their specific view in the CI or DOCS

Expand to view the summary

Build stats

Duration: 16 min 10 sec

🤖 GitHub comments

Expand to view the GitHub comments

To re-run your PR in the CI, just comment with:

/test : Re-trigger the build.
/package : Generate the packages and run the E2E tests.
/beats-tester : Run the installation tests with beats-tester.
run elasticsearch-ci/docs : Re-trigger the docs validation. (use unformatted text in the comment!)

elasticmachine · 2024-02-02T21:33:22Z

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS

Expand to view the summary

Build stats

Duration: 178 min 13 sec

❕ Flaky test report

No test was executed to be analysed.

🤖 GitHub comments

Expand to view the GitHub comments

To re-run your PR in the CI, just comment with:

/test : Re-trigger the build.
/package : Generate the packages and run the E2E tests.
/beats-tester : Run the installation tests with beats-tester.
run elasticsearch-ci/docs : Re-trigger the docs validation. (use unformatted text in the comment!)

mergify · 2024-02-05T13:16:58Z

This pull request does not have a backport label.
If this is a bug or security fix, could you label this PR @mmat11? 🙏.
For such, you'll need to label your PR with:

The upcoming major version of the Elastic Stack
The upcoming minor version of the Elastic Stack (if you're not pushing a breaking change)

To fixup this pull request, you need to add the backport labels for the needed
branches, such as:

backport-v8./d.0 is the label to automatically backport to the 8./d branch. /d is the digit

mmat11 · 2024-02-05T14:18:05Z

/test auditbeat integTest

mmat11 · 2024-02-05T15:21:19Z

/test auditbeat integTest arm

auditbeat/module/file_integrity/config.go

auditbeat/module/file_integrity/_meta/docs.asciidoc

auditbeat/module/file_integrity/eventreader_linux.go

auditbeat/module/file_integrity/schema/Source.go

mergify · 2024-02-06T08:35:30Z

This pull request is now in conflicts. Could you fix it? 🙏
To fixup this pull request, you can check out it locally. See documentation: https://help.github.com/articles/checking-out-pull-requests-locally/

git fetch upstream
git checkout -b matt/fim-ebpf upstream/matt/fim-ebpf
git merge upstream/main
git push upstream matt/fim-ebpf

mmat11 · 2024-02-08T17:48:49Z

/test auditbeat integTest arm

mmat11 · 2024-02-08T19:52:35Z

/test auditbeat integTest arm

andrewkroh

Just a few minor comments, I don't think anything that requires another look.

For future reference, in these larger changesets I would prefer if we didn't force push after the first peer review comments come in. Being able to view the changes since you last reviewed is valuable. At least in this repo, you are required to squash at merge so you still have an opportunity to clean up the commit message.

auditbeat/module/file_integrity/metricset.go

auditbeat/module/file_integrity/schema/Source.go

elasticmachine · 2024-02-09T17:49:56Z

💚 Build Succeeded

Buildkite Build
Commit: 04234eb

History

💔 Build #1213 failed df7dc6f
💚 Build #1208 succeeded b9982c8

cc @mmat11

elasticmachine · 2024-02-09T18:01:13Z

💚 Build Succeeded

Buildkite Build
Commit: 04234eb

History

💔 Build #1208 failed df7dc6f

cc @mmat11

elasticmachine · 2024-02-09T18:05:37Z

💚 Build Succeeded

Buildkite Build
Commit: 04234eb

History

💔 Build #377 failed df7dc6f

cc @mmat11

elasticmachine · 2024-02-09T18:16:26Z

💚 Build Succeeded

Buildkite Build
Commit: 04234eb

History

💔 Build #2426 failed df7dc6f

cc @mmat11

elasticmachine · 2024-02-09T18:17:55Z

💚 Build Succeeded

Buildkite Build
Commit: 04234eb

History

💔 Build #1538 failed df7dc6f

cc @mmat11

elasticmachine · 2024-02-09T18:32:42Z

💚 Build Succeeded

Buildkite Build
Commit: 04234eb

History

💔 Build #2877 failed df7dc6f
💚 Build #2799 succeeded ba46a56
💚 Build #2787 succeeded 3e7db0b
💔 Build #2456 failed 9b4acb4
💔 Build #2407 failed c372c54

cc @mmat11

pkoutsovasilis

LGTM!

botelastic bot added the needs_team Indicates that the issue/PR needs a Team:* label label Nov 28, 2023

mmat11 added Team:Security-Linux Platform Linux Platform Team in Security Solution and removed needs_team Indicates that the issue/PR needs a Team:* label labels Nov 28, 2023

mergify bot assigned mmat11 Nov 28, 2023

mmat11 force-pushed the matt/fim-ebpf branch 12 times, most recently from 8204ed0 to 9c9cac4 Compare December 4, 2023 16:18

elastic deleted a comment from mergify bot Dec 7, 2023

elastic deleted a comment from elasticmachine Dec 7, 2023

elastic deleted a comment from mergify bot Dec 7, 2023

mmat11 force-pushed the matt/fim-ebpf branch from 178f369 to c372c54 Compare February 2, 2024 20:49

mmat11 force-pushed the matt/fim-ebpf branch from c372c54 to 9b4acb4 Compare February 5, 2024 13:15

andrewkroh reviewed Feb 6, 2024

View reviewed changes

mmat11 force-pushed the matt/fim-ebpf branch 3 times, most recently from 136b45c to 3e7db0b Compare February 8, 2024 16:53

mmat11 force-pushed the matt/fim-ebpf branch from 3e7db0b to ba46a56 Compare February 8, 2024 18:52

andrewkroh approved these changes Feb 9, 2024

View reviewed changes

auditbeat/module/file_integrity/metricset.go Show resolved Hide resolved

auditbeat/module/file_integrity/schema/Source.go Outdated Show resolved Hide resolved

mmat11 force-pushed the matt/fim-ebpf branch from 811e939 to 91ade2e Compare February 9, 2024 17:23

mmat11 requested a review from a team as a code owner February 9, 2024 17:23

mmat11 force-pushed the matt/fim-ebpf branch from 91ade2e to 21cf489 Compare February 9, 2024 17:23

mmat11 added 2 commits February 9, 2024 18:29

fim: implement ebpf backend

bffeccd

logger: add ID to logger context

04234eb

pkoutsovasilis approved these changes Feb 9, 2024

View reviewed changes

cmacknz approved these changes Feb 13, 2024

View reviewed changes

Conversation

mmat11 commented Nov 28, 2023 • edited by andrewkroh Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Proposed commit message

Checklist

Author's Checklist

How to test this PR locally

Related issues

Uh oh!

elasticmachine commented Feb 2, 2024

❕ Build Aborted

Build stats

Test stats 🧪

Steps errors

auditbeat-rhel-9-rhel-9 - mage build unitTest

auditbeat-rhel-9-rhel-9 - mage build unitTest

auditbeat-rhel-9-rhel-9 - mage build unitTest

x-pack/auditbeat-build - mage update build test

x-pack/auditbeat-build - mage update build test

x-pack/auditbeat-build - mage update build test

x-pack/auditbeat-rhel-9-rhel-9 - mage build unitTest

x-pack/auditbeat-rhel-9-rhel-9 - mage build unitTest

x-pack/auditbeat-rhel-9-rhel-9 - mage build unitTest

Error signal

🤖 GitHub comments

Uh oh!

elasticmachine commented Feb 2, 2024

❕ Build Aborted

Build stats

🤖 GitHub comments

Uh oh!

elasticmachine commented Feb 2, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

💚 Build Succeeded

Build stats

❕ Flaky test report

🤖 GitHub comments

Uh oh!

mergify bot commented Feb 5, 2024

Uh oh!

mmat11 commented Feb 5, 2024

Uh oh!

mmat11 commented Feb 5, 2024

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

mergify bot commented Feb 6, 2024

Uh oh!

mmat11 commented Feb 8, 2024

Uh oh!

mmat11 commented Feb 8, 2024

Uh oh!

andrewkroh left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

elasticmachine commented Feb 9, 2024

💚 Build Succeeded

History

Uh oh!

elasticmachine commented Feb 9, 2024

💚 Build Succeeded

History

Uh oh!

elasticmachine commented Feb 9, 2024

💚 Build Succeeded

History

Uh oh!

elasticmachine commented Feb 9, 2024

💚 Build Succeeded

History

Uh oh!

elasticmachine commented Feb 9, 2024

💚 Build Succeeded

History

mmat11 commented Nov 28, 2023 •

edited by andrewkroh

Loading

`auditbeat-rhel-9-rhel-9 - mage build unitTest`

`auditbeat-rhel-9-rhel-9 - mage build unitTest`

`auditbeat-rhel-9-rhel-9 - mage build unitTest`

`x-pack/auditbeat-build - mage update build test`

`x-pack/auditbeat-build - mage update build test`

`x-pack/auditbeat-build - mage update build test`

`x-pack/auditbeat-rhel-9-rhel-9 - mage build unitTest`

`x-pack/auditbeat-rhel-9-rhel-9 - mage build unitTest`

`x-pack/auditbeat-rhel-9-rhel-9 - mage build unitTest`

`Error signal`

elasticmachine commented Feb 2, 2024 •

edited

Loading

andrewkroh left a comment •

edited

Loading