🚀 Benchmarks report

Package system 👍(2) 💚(0) 💔(1)

To see the full report comment with /test benchmark fullreport

Pinging @elastic/elastic-agent-data-plane (Team:Elastic-Agent-Data-Plane)

Pinging @elastic/sec-deployment-and-devices (Team:Security-Deployment and Devices)

I wonder what would it cost us (in terms of the image size) to include journalctl in our regular Ubuntu/Ubi/Wolfi images?

Did we look into it?

I think it's not the best user experience if ask to use the complete image for such a common use-case.

I don't think we (data-plane) looked into it. IIRC when the change to use journalctl was merged in Beats, some tests on this repo broke and the decision at the time was to use the complete image, there is a little bit of context here: #10998. I didn't question it at the time, however now this use case seems to be growing.

I did a quick test by just installing the systemd package in our 9.0.0 wolfi image and it only adds about 170Mb:

FROM docker.elastic.co/elastic-agent/elastic-agent-wolfi:9.0.0
USER root
RUN apk update
RUN apk add systemd
ENTRYPOINT ["/usr/bin/journalctl", "--version"]

elastic-agent-wolfi-journald                          latest           f91135ef22b0   4 minutes ago   1.84GB
docker.elastic.co/elastic-agent/elastic-agent-wolfi   9.0.0            2aad676542e0   13 days ago     1.67GB

I like the idea of adding journalctl to the wolfi images, specially because wolfi repositories contain the latest systemd, which is a huge advantage compared with the current complete image that ships an older version of journalctl.

I'd merge this PR as it is, because it documents the current state and how to use the journald input with Elastic-Agent, allowing users to already benefit from it.

Once we have a new release of Elastic-Agent with journalctl in a smaller image, we can update the docs, likely keeping version statements, so users know which image variants in which versions contain journalclt.

So, the size increase for Wolfi is only about 10%. I'm fine with merging this PR as it is but it should be addressed by extending all of our Docker images and having journalctl there.

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube

Hi! We just realized that we haven't looked into this PR in a while. We're sorry! We're labeling this issue as Stale to make it hit our filters and make sure we get back to it as soon as possible. In the meantime, it'd be extremely helpful if you could take a look at it as well and confirm its relevance. A simple comment with a nice emoji will be enough :+1. Thank you for your contribution!

I updated the PR to match what is currently released.

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube

💚 Build Succeeded

• Buildkite Build
• Commit: 7880e5f

History

• 💔 Build #27767 failed 8462e24
• 💚 Build #27717 succeeded e896a72
• 💔 Build #26326 failed 73e476d
• 💔 Build #25149 failed b4e4c43
• 💚 Build #24891 succeeded e16a3ac

cc @belimawr

Package iptables - 1.21.1 containing this change is available at https://epr.elastic.co/package/iptables/1.21.1/

Package journald - 1.2.1 containing this change is available at https://epr.elastic.co/package/journald/1.2.1/

Package system - 2.3.2 containing this change is available at https://epr.elastic.co/package/system/2.3.2/