Skip to content

[8.13](backport #38199) [Auditbeat] fim(ebpf): enrich file events with process data#38742

Merged
pkoutsovasilis merged 5 commits into8.13from
mergify/bp/8.13/pr-38199
Apr 9, 2024
Merged

[8.13](backport #38199) [Auditbeat] fim(ebpf): enrich file events with process data#38742
pkoutsovasilis merged 5 commits into8.13from
mergify/bp/8.13/pr-38199

Conversation

@mergify
Copy link
Copy Markdown
Contributor

@mergify mergify bot commented Apr 5, 2024 •
edited by zube bot
Loading

Proposed commit message

fim(ebpf): enrich file events with process data

Checklist

  • My code follows the style guidelines of this project
  • I have commented my code, particularly in hard-to-understand areas
  • I have made corresponding changes to the documentation
  • I have made corresponding change to the default configuration files
  • I have added tests that prove my fix is effective or that my feature works
  • I have added an entry in CHANGELOG.next.asciidoc or CHANGELOG-developer.next.asciidoc.

Author's Checklist

Related issues

elastic/integrations#7401

Screenshot

Screenshot 2024-04-02 at 2 31 57 PM
This is an automatic backport of pull request #38199 done by [Mergify](https://mergify.com).

@mmat11 @mergify
[Auditbeat] fim(ebpf): enrich file events with process data (#38199)
895a5b9 
* fim(ebpf): enrich file events with process data

* apply review suggestions

* apply review suggestions

* fix(fim/ebpf): move process fields to event root and insert them so keys do not contain dots

* fix(fim/ebpf): refactor HostID to utilise sync.OnceValue and expose boot time

* fix(fim/ebpf): refactor TicksPerSecond to utilise sync.OnceValue

* fix(fim/ebpf): remove empty slice allocation

* chore: go mod tidy

* fix: explicitly set go 1.21.8 in go.mod

* fix(fim/ebpf): nil slice of errors in TestNewEventFromEbpfEvent

* fix(fim/ebpf): remove re-declaration of already ecs included fields

* fix(fim/ebpf): utilise OnceValues to declutter the code

* fix(fim/ebpf): remove x-pack import from OSS package

* fix(fim/ebpf): propagate process fields changes to integration tests

* chore: go mod tidy

* ci: temporary solution to outdated docker compose python library

* ci: transition to a fixed tag for docker image instead of a rolling one

---------

Co-authored-by: Panos Koutsovasilis <panos.koutsovasilis@elastic.co>
Co-authored-by: Pierre HILBERT <pierre.hilbert@elastic.co>
(cherry picked from commit dbdaac3)

# Conflicts:
#	go.mod
#	go.sum
@mergify mergify bot requested review from a team as code owners April 5, 2024 13:32
@mergify mergify bot added the backport label Apr 5, 2024
@mergify mergify bot requested a review from a team as a code owner April 5, 2024 13:32
@mergify mergify bot added the conflicts There is a conflict in the backported pull request label Apr 5, 2024
@mergify mergify bot requested review from faec and leehinman and removed request for a team April 5, 2024 13:32
@mergify
Copy link
Copy Markdown
Contributor Author

mergify bot commented Apr 5, 2024

Cherry-pick of dbdaac3 has failed:

On branch mergify/bp/8.13/pr-38199
Your branch is up to date with 'origin/8.13'.

You are currently cherry-picking commit dbdaac363e.
  (fix conflicts and run "git cherry-pick --continue")
  (use "git cherry-pick --skip" to skip this patch)
  (use "git cherry-pick --abort" to cancel the cherry-pick operation)

Changes to be committed:
	modified:   CHANGELOG.next.asciidoc
	modified:   NOTICE.txt
	modified:   auditbeat/module/file_integrity/event.go
	modified:   auditbeat/module/file_integrity/event_linux.go
	modified:   auditbeat/module/file_integrity/event_linux_test.go
	modified:   auditbeat/tests/system/test_file_integrity.py
	new file:   libbeat/ebpf/sys/sys.go
	new file:   libbeat/ebpf/sys/time.go
	modified:   libbeat/tests/system/requirements.txt
	modified:   libbeat/tests/system/requirements_aix.txt
	modified:   metricbeat/Dockerfile

Unmerged paths:
  (use "git add <file>..." to mark resolution)
	both modified:   go.mod
	both modified:   go.sum

To fix up this pull request, you can check it out locally. See documentation: https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/checking-out-pull-requests-locally

@botelastic botelastic bot added the needs_team Indicates that the issue/PR needs a Team:* label label Apr 5, 2024
@cla-checker-service
Copy link
Copy Markdown

cla-checker-service bot commented Apr 5, 2024 •
edited
Loading

💚 CLA has been signed

@pierrehilbert pierrehilbert added the Team:Elastic-Agent Label for the Agent team label Apr 5, 2024
@elasticmachine
Copy link
Copy Markdown
Contributor

elasticmachine commented Apr 5, 2024

Pinging @elastic/elastic-agent (Team:Elastic-Agent)

@botelastic botelastic bot removed the needs_team Indicates that the issue/PR needs a Team:* label label Apr 5, 2024
@elasticmachine
Copy link
Copy Markdown
Contributor

elasticmachine commented Apr 5, 2024 •
edited
Loading

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS
Pipeline View Test View Changes Artifacts preview preview

Expand to view the summary

Build stats

  • Duration: 180 min 52 sec

❕ Flaky test report

No test was executed to be analysed.

🤖 GitHub comments

Expand to view the GitHub comments

To re-run your PR in the CI, just comment with:

  • /test : Re-trigger the build.

  • /package : Generate the packages and run the E2E tests.

  • /beats-tester : Run the installation tests with beats-tester.

  • run elasticsearch-ci/docs : Re-trigger the docs validation. (use unformatted text in the comment!)

@cmacknz
Copy link
Copy Markdown
Member

cmacknz commented Apr 5, 2024

This is a new feature. Not sure it is valid to backport this. The Python docker-compose fix should have been a separate PR. That fix also needs to go to 7.17 where the feature additional definitely can't go.

@cmacknz
Copy link
Copy Markdown
Member

cmacknz commented Apr 5, 2024

I'm not opposed to backporting this if it was always planned to be released in an 8.13.x patch release, I just want to doublecheck we aren't backporting this purely because of the CI fix it contains.

@cmacknz
Copy link
Copy Markdown
Member

cmacknz commented Apr 5, 2024

I have set the 7.17 backport which contains only the CI fix to also backport to 8.13 #38743.

@pkoutsovasilis
Copy link
Copy Markdown
Contributor

pkoutsovasilis commented Apr 5, 2024

This is a new feature. Not sure it is valid to backport this. The Python docker-compose fix should have been a separate PR. That fix also needs to go to 7.17 where the feature additional definitely can't go.

the feature is supposed to be backported @cmacknz so all under control.

@pkoutsovasilis
Copy link
Copy Markdown
Contributor

pkoutsovasilis commented Apr 5, 2024

so this CLA failure is for matt1 who is no longer part of elastic. should we merge this @cmacknz ?

@mergify
Copy link
Copy Markdown
Contributor Author

mergify bot commented Apr 8, 2024

This pull request has not been merged yet. Could you please review and merge it @pkoutsovasilis? 🙏

@pkoutsovasilis pkoutsovasilis merged commit 63fc042 into 8.13 Apr 9, 2024
@pkoutsovasilis pkoutsovasilis deleted the mergify/bp/8.13/pr-38199 branch April 9, 2024 08:58
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@faec faec Awaiting requested review from faec faec is a code owner automatically assigned from elastic/elastic-agent-data-plane

@leehinman leehinman Awaiting requested review from leehinman leehinman is a code owner automatically assigned from elastic/elastic-agent-data-plane

1 more reviewer

@pkoutsovasilis pkoutsovasilis pkoutsovasilis approved these changes

Reviewers whose approvals may not affect merge requirements

Assignees

@pkoutsovasilis pkoutsovasilis

Labels

backport conflicts There is a conflict in the backported pull request Team:Elastic-Agent Label for the Agent team

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

5 participants

@elasticmachine @cmacknz @pkoutsovasilis @pierrehilbert @mmat11