From 911b2e7d452711e240f98aa6101128668199e0fb Mon Sep 17 00:00:00 2001 From: Dan Kortschak Date: Wed, 24 Jan 2024 20:00:07 +1030 Subject: [PATCH] filebeat/input/{tcp,udp}: fix the base of the queue length parsers This was incorrectly claimed to be decimal due to misreading the kernel source. --- CHANGELOG.next.asciidoc | 1 + filebeat/input/tcp/input.go | 4 ++-- filebeat/input/udp/input.go | 4 ++-- 3 files changed, 5 insertions(+), 4 deletions(-) diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc index 4c6a22d5edc8..3fe46b65e0c2 100644 --- a/CHANGELOG.next.asciidoc +++ b/CHANGELOG.next.asciidoc @@ -74,6 +74,7 @@ https://github.com/elastic/beats/compare/v8.8.1\...main[Check the HEAD diff] - Fix handling of Juniper SRX structured data when there is no leading junos element. {issue}36270[36270] {pull}36308[36308] - Fix Filebeat Cisco module with missing escape character {issue}36325[36325] {pull}36326[36326] - Added a fix for Crowdstrike pipeline handling process arrays {pull}36496[36496] +- Fix TCP/UDP metric queue length parsing base. {pull}37714[37714] *Heartbeat* diff --git a/filebeat/input/tcp/input.go b/filebeat/input/tcp/input.go index 0e2990c8f1d5..1b3ffa7c2aa4 100644 --- a/filebeat/input/tcp/input.go +++ b/filebeat/input/tcp/input.go @@ -342,10 +342,10 @@ func procNetTCP(path string, addr []string, hasUnspecified bool, addrIsUnspecifi } found = true - // queue lengths are decimal, e.g.: + // queue lengths are hex, e.g.: // - https://elixir.bootlin.com/linux/v6.2.11/source/net/ipv4/tcp_ipv4.c#L2643 // - https://elixir.bootlin.com/linux/v6.2.11/source/net/ipv6/tcp_ipv6.c#L1987 - v, err := strconv.ParseInt(string(r), 10, 64) + v, err := strconv.ParseInt(string(r), 16, 64) if err != nil { return 0, fmt.Errorf("failed to parse rx_queue: %w", err) } diff --git a/filebeat/input/udp/input.go b/filebeat/input/udp/input.go index e7e2092a3db8..cd7ca0c56051 100644 --- a/filebeat/input/udp/input.go +++ b/filebeat/input/udp/input.go @@ -340,10 +340,10 @@ func procNetUDP(path string, addr []string, hasUnspecified bool, addrIsUnspecifi } found = true - // queue lengths and drops are decimal, e.g.: + // queue lengths and drops are hex, e.g.: // - https://elixir.bootlin.com/linux/v6.2.11/source/net/ipv4/udp.c#L3110 // - https://elixir.bootlin.com/linux/v6.2.11/source/net/ipv6/datagram.c#L1048 - v, err := strconv.ParseInt(string(r), 10, 64) + v, err := strconv.ParseInt(string(r), 16, 64) if err != nil { return 0, 0, fmt.Errorf("failed to parse rx_queue: %w", err) }