Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Create fsnotify watcher only when starting file_integrity module #19505

Merged
merged 2 commits into from
Jul 7, 2020
Merged

Create fsnotify watcher only when starting file_integrity module #19505

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
ae44ee5
Create fsnotify watcher only when starting file_integrity module
vjsamuel Jun 30, 2020
f293c68
Add close to Start() so that failed starts don't create resource leaks
vjsamuel Jul 1, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions CHANGELOG.next.asciidoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -148,6 +148,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d
- system/socket: Fix dataset using 100% CPU and becoming unresponsive in some scenarios. {pull}19033[19033]
- system/socket: Fixed tracking of long-running connections. {pull}19033[19033]
- system/package: Fix librpm loading on Fedora 31/32. {pull}NNNN[NNNN]
- file_integrity: Create fsnotify watcher only when starting file_integrity module {pull}19505[19505]

*Filebeat*

Expand Down
18 changes: 10 additions & 8 deletions auditbeat/module/file_integrity/eventreader_fsnotify.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,20 +39,22 @@ type reader struct {

// NewEventReader creates a new EventProducer backed by fsnotify.
func NewEventReader(c Config) (EventProducer, error) {
watcher, err := monitor.New(c.Recursive)
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I wonder if this was here to detect config mistakes early, @andrewkroh probably you can confirm

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't think much validation is gained with this particular instantiation from a config validation perspective. So moving it into Start should be OK.

if err != nil {
return nil, err
}

return &reader{
watcher: watcher,
config: c,
log: logp.NewLogger(moduleName),
config: c,
log: logp.NewLogger(moduleName),
}, nil
}

func (r *reader) Start(done <-chan struct{}) (<-chan Event, error) {
watcher, err := monitor.New(r.config.Recursive)
if err != nil {
return nil, err
}

r.watcher = watcher
if err := r.watcher.Start(); err != nil {
// Ensure that watcher is closed so that we don't leak watchers
r.watcher.Close()
return nil, errors.Wrap(err, "unable to start watcher")
}

Expand Down