Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Osquerybeat: Fix restart flags after previously bad config #28827

Merged

Conversation

aleksmaus
Copy link
Member

What does this PR do?

Fixes the oquery flags update defect.

The issue is reproducible with the following steps:

  1. Apply bad config flag
{
  "options": {
    "disable_events": false,
    "enable_file_events": true
    "enable_ntfs_publisher": true
  }
 }
  1. Osquery stops with error
[elastic_agent.osquerybeat][error] process exited with error: ERROR: unknown command line flag 'enable_ntfs_publisher': exit status 1
  1. Remove enable_ntfs_publisher option.
  2. The osquery uses old flags to (visible in debug log) and fails.

Expected result, the new flags are used and osquery becomes usable (can issue ad-hoc queries for example)

This is a minimal change to fix this for 7.16 next RC is on 11/10.

If I get time before 11/10, will revisit the osquery runner one more time.
If not will leave it for 8.0 to improve.

Why is it important?

Fixes the osquery configuration options update defect in 7.16

Checklist

  • My code follows the style guidelines of this project
  • I have commented my code, particularly in hard-to-understand areas

@botelastic botelastic bot added needs_team Indicates that the issue/PR needs a Team:* label and removed needs_team Indicates that the issue/PR needs a Team:* label labels Nov 4, 2021
Copy link

@james-elastic james-elastic left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

good catch

@elasticmachine
Copy link
Collaborator

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS
Pipeline View Test View Changes Artifacts preview preview

Expand to view the summary

Build stats

  • Start Time: 2021-11-04T21:13:47.231+0000

  • Duration: 66 min 37 sec

  • Commit: 52e485d

Test stats 🧪

Test Results
Failed 0
Passed 4027
Skipped 0
Total 4027

💚 Flaky test report

Tests succeeded.

🤖 GitHub comments

To re-run your PR in the CI, just comment with:

  • /test : Re-trigger the build.

  • /package : Generate the packages and run the E2E tests.

  • /beats-tester : Run the installation tests with beats-tester.

@aleksmaus aleksmaus merged commit 8d8e387 into elastic:master Nov 5, 2021
@aleksmaus aleksmaus deleted the fix/osquery_restart_after_bad_config branch November 5, 2021 00:25
mergify bot pushed a commit that referenced this pull request Nov 5, 2021
aleksmaus added a commit that referenced this pull request Nov 5, 2021
v1v added a commit to v1v/beats that referenced this pull request Nov 8, 2021
…in-the-package-binareis

* upstream/master:
  allows disable pod events enrichment with deployment name (elastic#28521)
  Remove Docker input from Filebeat (elastic#28817)
  [breaking] Make default_field: false the default for all fields (elastic#28596)
  Osquerybeat: Improve osquery client connect code (elastic#28848)
  Add crawler  metrics into the stats metricset for Enterprise Search (elastic#28790)
  Remove the now deprecated appsearch module from metricbeat (elastic#28850)
  Remove Beat generators (elastic#28816)
  chore: upload files to Google Storage when they exist (elastic#28836)
  Revert "chore(ci): disable E2E tests in Beats (elastic#28715)" (elastic#28812)
  Deprecate generating custom Beats (elastic#28814)
  [Metricbeat] upgrade flatbuffers to 1.12.1 (elastic#28094)
  Osquerybeat: Fix restart flags after previously bad config (elastic#28827)
  Force ECS and JSON logging for libbeat/logp (elastic#28573)
  Filebeat: Error on startup for unconfigured module (elastic#28818)
  Deprecate log input in favour of filestream (elastic#28623)
  Fix some spelling mistakes (elastic#28080)
@aleksmaus aleksmaus added the backport-v8.0.0 Automated backport with mergify label Nov 10, 2021
mergify bot pushed a commit that referenced this pull request Nov 10, 2021
aleksmaus added a commit that referenced this pull request Nov 11, 2021
leweafan pushed a commit to leweafan/beats that referenced this pull request Apr 28, 2023
…in-the-package-binareis

* upstream/master:
  allows disable pod events enrichment with deployment name (elastic#28521)
  Remove Docker input from Filebeat (elastic#28817)
  [breaking] Make default_field: false the default for all fields (elastic#28596)
  Osquerybeat: Improve osquery client connect code (elastic#28848)
  Add crawler  metrics into the stats metricset for Enterprise Search (elastic#28790)
  Remove the now deprecated appsearch module from metricbeat (elastic#28850)
  Remove Beat generators (elastic#28816)
  chore: upload files to Google Storage when they exist (elastic#28836)
  Revert "chore(ci): disable E2E tests in Beats (elastic#28715)" (elastic#28812)
  Deprecate generating custom Beats (elastic#28814)
  [Metricbeat] upgrade flatbuffers to 1.12.1 (elastic#28094)
  Osquerybeat: Fix restart flags after previously bad config (elastic#28827)
  Force ECS and JSON logging for libbeat/logp (elastic#28573)
  Filebeat: Error on startup for unconfigured module (elastic#28818)
  Deprecate log input in favour of filestream (elastic#28623)
  Fix some spelling mistakes (elastic#28080)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
backport-v7.16.0 Automated backport with mergify backport-v8.0.0 Automated backport with mergify bug Team:Asset Mgt v7.16.0
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants