Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Auditbeat's file_integrity module panics under Linux #7753

Closed
adriansr opened this issue Jul 26, 2018 · 0 comments
Closed

Auditbeat's file_integrity module panics under Linux #7753

adriansr opened this issue Jul 26, 2018 · 0 comments
Labels
Auditbeat bug

Comments

@adriansr
Copy link
Contributor

Users are reporting an occasional crash in auditbeat when using the file_integrity module.

Jul 26 12:28:46 ip-172-23-14-215 auditbeat[25577]: panic: runtime error: invalid memory address or nil pointer dereference
Jul 26 12:28:46 ip-172-23-14-215 auditbeat[25577]: [signal SIGSEGV: segmentation violation code=0x1 addr=0x20 pc=0xe30405]
Jul 26 12:28:46 ip-172-23-14-215 auditbeat[25577]: goroutine 237 [running]:
Jul 26 12:28:46 ip-172-23-14-215 auditbeat[25577]: github.com/elastic/beats/vendor/github.com/joeshaw/multierror.(*MultiError).Error(0xc420f1c4c0, 0xb09834, 0x220000000003)
Jul 26 12:28:46 ip-172-23-14-215 auditbeat[25577]: #011/go/src/github.com/elastic/beats/vendor/github.com/joeshaw/multierror/multierror.go:43 +0x95
Jul 26 12:28:46 ip-172-23-14-215 auditbeat[25577]: github.com/elastic/beats/vendor/github.com/pkg/errors.(*withMessage).Error(0xc420f1c4e0, 0xaa67f7, 0x1a820f1c680)
Jul 26 12:28:46 ip-172-23-14-215 auditbeat[25577]: #011/go/src/github.com/elastic/beats/vendor/github.com/pkg/errors/errors.go:228 +0x37
Jul 26 12:28:46 ip-172-23-14-215 auditbeat[25577]: github.com/elastic/beats/vendor/github.com/pkg/errors.(*withStack).Error(0xc420f1c520, 0xc420639500, 0x600016880f8)
Jul 26 12:28:46 ip-172-23-14-215 auditbeat[25577]: #011<autogenerated>:1 +0x3c
Jul 26 12:28:46 ip-172-23-14-215 auditbeat[25577]: github.com/elastic/beats/vendor/go.uber.org/zap/zapcore.encodeError(0x163c046, 0x5, 0x1e95ec0, 0xc420f1c520, 0x1eb1d80, 0xc420f1c680, 0xc420f1c660, 0xc4202fa880)
Jul 26 12:28:46 ip-172-23-14-215 auditbeat[25577]: #011/go/src/github.com/elastic/beats/vendor/go.uber.org/zap/zapcore/error.go:46 +0x49
Jul 26 12:28:46 ip-172-23-14-215 auditbeat[25577]: github.com/elastic/beats/vendor/go.uber.org/zap/zapcore.Field.AddTo(0x163c046, 0x5, 0x19, 0x0, 0x0, 0x0, 0x1529860, 0xc420f1c520, 0x1eb1d80, 0xc420f1c680)
Jul 26 12:28:46 ip-172-23-14-215 auditbeat[25577]: #011/go/src/github.com/elastic/beats/vendor/go.uber.org/zap/zapcore/field.go:165 +0xc90
Jul 26 12:28:46 ip-172-23-14-215 auditbeat[25577]: github.com/elastic/beats/vendor/go.uber.org/zap/zapcore.addFields(0x1eb1d80, 0xc420f1c680, 0xc420c6f500, 0x1, 0x2)
Jul 26 12:28:46 ip-172-23-14-215 auditbeat[25577]: #011/go/src/github.com/elastic/beats/vendor/go.uber.org/zap/zapcore/field.go:199 +0x62
Jul 26 12:28:46 ip-172-23-14-215 auditbeat[25577]: github.com/elastic/beats/vendor/go.uber.org/zap/zapcore.consoleEncoder.writeContext(0xc42025a060, 0xc420f1c600, 0xc420c6f500, 0x1, 0x2)
Jul 26 12:28:46 ip-172-23-14-215 auditbeat[25577]: #011/go/src/github.com/elastic/beats/vendor/go.uber.org/zap/zapcore/console_encoder.go:131 +0xcf
Jul 26 12:28:46 ip-172-23-14-215 auditbeat[25577]: github.com/elastic/beats/vendor/go.uber.org/zap/zapcore.consoleEncoder.EncodeEntry(0xc42025a060, 0x1, 0xbece8d7f92ab9460, 0x45664780e550e, 0x1eeebe0, 0x1645176, 0xe, 0x164c469, 0x16, 0x1, ...)
Jul 26 12:28:46 ip-172-23-14-215 auditbeat[25577]: #011/go/src/github.com/elastic/beats/vendor/go.uber.org/zap/zapcore/console_encoder.go:110 +0x3de
Jul 26 12:28:46 ip-172-23-14-215 auditbeat[25577]: github.com/elastic/beats/vendor/go.uber.org/zap/zapcore.(*ioCore).Write(0xc420258bd0, 0x1, 0xbece8d7f92ab9460, 0x45664780e550e, 0x1eeebe0, 0x1645176, 0xe, 0x164c469, 0x16, 0x1, ...)
Jul 26 12:28:46 ip-172-23-14-215 auditbeat[25577]: #011/go/src/github.com/elastic/beats/vendor/go.uber.org/zap/zapcore/core.go:86 +0xa9
Jul 26 12:28:46 ip-172-23-14-215 auditbeat[25577]: github.com/elastic/beats/vendor/go.uber.org/zap/zapcore.(*CheckedEntry).Write(0xc420aca2c0, 0xc420c6f500, 0x1, 0x2)
Jul 26 12:28:46 ip-172-23-14-215 auditbeat[25577]: #011/go/src/github.com/elastic/beats/vendor/go.uber.org/zap/zapcore/entry.go:215 +0xe7
Jul 26 12:28:46 ip-172-23-14-215 auditbeat[25577]: github.com/elastic/beats/vendor/go.uber.org/zap.(*SugaredLogger).log(0xc4201881f0, 0xc420da3f01, 0x164c469, 0x16, 0x0, 0x0, 0x0, 0xc420da3dc8, 0x2, 0x2)
Jul 26 12:28:46 ip-172-23-14-215 auditbeat[25577]: #011/go/src/github.com/elastic/beats/vendor/go.uber.org/zap/sugar.go:234 +0xf6
Jul 26 12:28:46 ip-172-23-14-215 auditbeat[25577]: github.com/elastic/beats/vendor/go.uber.org/zap.(*SugaredLogger).Warnw(0xc4201881f0, 0x164c469, 0x16, 0xc420da3dc8, 0x2, 0x2)
Jul 26 12:28:46 ip-172-23-14-215 auditbeat[25577]: #011/go/src/github.com/elastic/beats/vendor/go.uber.org/zap/sugar.go:185 +0x83
Jul 26 12:28:46 ip-172-23-14-215 auditbeat[25577]: github.com/elastic/beats/libbeat/logp.(*Logger).Warnw(0xc420188200, 0x164c469, 0x16, 0xc420da3dc8, 0x2, 0x2)
Jul 26 12:28:46 ip-172-23-14-215 auditbeat[25577]: #011/go/src/github.com/elastic/beats/libbeat/logp/logger.go:143 +0x60
Jul 26 12:28:46 ip-172-23-14-215 auditbeat[25577]: github.com/elastic/beats/auditbeat/module/file_integrity.(*reader).consumeEvents(0xc4201e6420, 0xc420198960)
Jul 26 12:28:46 ip-172-23-14-215 auditbeat[25577]: #011/go/src/github.com/elastic/beats/auditbeat/module/file_integrity/eventreader_fsnotify.go:89 +0x62d
Jul 26 12:28:46 ip-172-23-14-215 auditbeat[25577]: created by github.com/elastic/beats/auditbeat/module/file_integrity.(*reader).Start
Jul 26 12:28:46 ip-172-23-14-215 auditbeat[25577]: #011/go/src/github.com/elastic/beats/auditbeat/module/file_integrity/eventreader_fsnotify.go:42 +0x90```

For confirmed bugs, please report:
- Version: 6.2.4 & 6.3.1
- Operating System: Linux
- Discuss Forum URL: https://discuss.elastic.co/t/auditbeat-randomly-shuts-down/135335
- Steps to Reproduce: n/a
adriansr added a commit to adriansr/beats that referenced this issue Jul 26, 2018
@adriansr
Protect against nil errors from inotify (elastic#7753)
13a3633 
Users are experiencing occasional crashes in auditbeat that are caused
by a nil error being printed to the logs. Adding some defensive code to
prevent auditbeat from panicking.

Fixes elastic#7753
@adriansr adriansr mentioned this issue Jul 26, 2018
Merged
andrewkroh pushed a commit that referenced this issue Jul 26, 2018
@adriansr @andrewkroh
Protect against nil errors from inotify (#7753) (#7754)
9cd073f 
Users are experiencing occasional crashes in auditbeat that are caused
by a nil error being printed to the logs. Adding some defensive code to
prevent auditbeat from panicking.

Fixes #7753
@adriansr adriansr mentioned this issue Jul 26, 2018
Merged
adriansr added a commit to adriansr/beats that referenced this issue Jul 26, 2018
@adriansr
Protect against nil errors from inotify (elastic#7753) (elastic#7754)
95fa8e5 
Users are experiencing occasional crashes in auditbeat that are caused
by a nil error being printed to the logs. Adding some defensive code to
prevent auditbeat from panicking.

Fixes elastic#7753

(cherry picked from commit 9cd073f)
@adriansr adriansr mentioned this issue Jul 26, 2018
Merged
adriansr added a commit to adriansr/beats that referenced this issue Jul 26, 2018
@adriansr
Protect against nil errors from inotify (elastic#7753) (elastic#7754)
3d565b7 
Users are experiencing occasional crashes in auditbeat that are caused
by a nil error being printed to the logs. Adding some defensive code to
prevent auditbeat from panicking.

Fixes elastic#7753

(cherry picked from commit 9cd073f)
andrewkroh pushed a commit that referenced this issue Jul 27, 2018
@adriansr @andrewkroh
Protect against nil errors from inotify (#7753) (#7754) (#7756)
a70065b 
Users are experiencing occasional crashes in auditbeat that are caused
by a nil error being printed to the logs. Adding some defensive code to
prevent auditbeat from panicking.

Fixes #7753

(cherry picked from commit 9cd073f)
ruflin pushed a commit that referenced this issue Jul 30, 2018
@adriansr @ruflin
Protect against nil errors from inotify (#7753) (#7754) (#7761)
0541868 
Users are experiencing occasional crashes in auditbeat that are caused
by a nil error being printed to the logs. Adding some defensive code to
prevent auditbeat from panicking.

Fixes #7753

(cherry picked from commit 9cd073f)
leweafan pushed a commit to leweafan/beats that referenced this issue Apr 28, 2023
@adriansr @andrewkroh
Protect against nil errors from inotify (elastic#7753) (elastic#7754) (…
2a398dc 
…elastic#7756)

Users are experiencing occasional crashes in auditbeat that are caused
by a nil error being printed to the logs. Adding some defensive code to
prevent auditbeat from panicking.

Fixes elastic#7753

(cherry picked from commit 4843d6f)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
Auditbeat bug
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
1 participant
@adriansr