packetbeat/beater: make sure Npcap installation runs before interface…

…s are needed (#30396) (#30410) Previously installNpcap was run after Create, which depends on having interfaces up to establish sniffers, and so was too late. So move the call to the front of Create to ensure that the library is installed by the time that it is needed. (cherry picked from commit 0c187d5) Co-authored-by: Dan Kortschak <[email protected]>
elastic · Feb 15, 2022 · f26e761 · f26e761
1 parent bd983fe
commit f26e761
Show file tree

Hide file tree

Showing 3 changed files with 7 additions and 7 deletions.
diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc
@@ -131,7 +131,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d
 
 *Packetbeat*
 
-- Add automated OEM Npcap installation handling. {pull}29112[29112]
+- Add automated OEM Npcap installation handling. {pull}29112[29112] {pull}30396[30396]
 - Add support for capturing TLS random number and OCSP status request details. {issue}29962[29962] {pull}30102[30102]
 
 *Functionbeat*

diff --git a/packetbeat/beater/packetbeat.go b/packetbeat/beater/packetbeat.go
@@ -111,12 +111,6 @@ func (pb *packetbeat) Run(b *beat.Beat) error {
 		}
 	}()
 
-	// Install Npcap if needed.
-	err := installNpcap(b)
-	if err != nil {
-		return err
-	}
-
 	if !b.Manager.Enabled() {
 		return pb.runStatic(b, pb.factory)
 	}

diff --git a/packetbeat/beater/processor.go b/packetbeat/beater/processor.go
@@ -113,6 +113,12 @@ func (p *processorFactory) Create(pipeline beat.PipelineConnector, cfg *common.C
 		return nil, err
 	}
 
+	// Install Npcap if needed.
+	err = installNpcap(p.beat)
+	if err != nil {
+		return nil, err
+	}
+
 	publisher, err := publish.NewTransactionPublisher(
 		p.beat.Info.Name,
 		p.beat.Publisher,