Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Cherry-pick #19033 to 7.7: Auditbeat: Fixes for system/socket dataset #19081

Merged
merged 1 commit into from
Jun 9, 2020

Commits on Jun 9, 2020

  1. Auditbeat: Fixes for system/socket dataset (elastic#19033)

    Fixes two problems with the system/socket dataset:
    
    - A bug in the internal state of the socket dataset that lead to an infinite
      loop in systems were the kernel aggressively reuses sockets (observed
      in kernel 2.6 / CentOS/RHEL 6.x).
    - Socket expiration wasn't working as expected due to it using an
      uninitialized timestamp: Flows were expiring at every check.
    
    Also fixes other two minor issues:
    
    - A flow could be terminated twice by different code paths leading to wrong
      numFlows calculation and duplicated flows indexed.
    - Decoupled the status debug log and socket cleanup into separate goroutines
      so that logging is still performed under high load situations.
    
    (cherry picked from commit 665b67f)
    adriansr committed Jun 9, 2020
    Configuration menu
    Copy the full SHA
    2cf8a46 View commit details
    Browse the repository at this point in the history