Skip to content

Commit

Permalink
Create fsnotify watcher only when starting file_integrity module (ela…
Browse files Browse the repository at this point in the history
…stic#19505)

* Create fsnotify watcher only when starting file_integrity module

* Add close to Start() so that failed starts don't create resource leaks
  • Loading branch information
vjsamuel authored Jul 7, 2020
1 parent 238a9f0 commit de897b0
Show file tree
Hide file tree
Showing 2 changed files with 11 additions and 8 deletions.
1 change: 1 addition & 0 deletions CHANGELOG.next.asciidoc
Original file line number Diff line number Diff line change
Expand Up @@ -149,6 +149,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d
- system/socket: Fix dataset using 100% CPU and becoming unresponsive in some scenarios. {pull}19033[19033]
- system/socket: Fixed tracking of long-running connections. {pull}19033[19033]
- system/package: Fix librpm loading on Fedora 31/32. {pull}NNNN[NNNN]
- file_integrity: Create fsnotify watcher only when starting file_integrity module {pull}19505[19505]

*Filebeat*

Expand Down
18 changes: 10 additions & 8 deletions auditbeat/module/file_integrity/eventreader_fsnotify.go
Original file line number Diff line number Diff line change
Expand Up @@ -39,20 +39,22 @@ type reader struct {

// NewEventReader creates a new EventProducer backed by fsnotify.
func NewEventReader(c Config) (EventProducer, error) {
watcher, err := monitor.New(c.Recursive)
if err != nil {
return nil, err
}

return &reader{
watcher: watcher,
config: c,
log: logp.NewLogger(moduleName),
config: c,
log: logp.NewLogger(moduleName),
}, nil
}

func (r *reader) Start(done <-chan struct{}) (<-chan Event, error) {
watcher, err := monitor.New(r.config.Recursive)
if err != nil {
return nil, err
}

r.watcher = watcher
if err := r.watcher.Start(); err != nil {
// Ensure that watcher is closed so that we don't leak watchers
r.watcher.Close()
return nil, errors.Wrap(err, "unable to start watcher")
}

Expand Down

0 comments on commit de897b0

Please sign in to comment.