[7.17](backport #39362) [Auditbeat/FIM/fsnotify]: prevent losing events for recursive mode on OS X

[mergify]

Proposed commit message

This PR prevents FIM from losing events for recursive mode on Mac OS X even when the watchFile of the root dir, added to be monitored, returns an error by always walking the dir. Specifically, this discrepancy, between Linux and OS X oses, is due to the fact that in the latter the underlying library, namely fsnotify, when you add a watch of a directory it walks the directory and adds the respective sub-dir watchers. If any of these fail, e.g. with EACCESS, it returns an error. However, auditbeat's wrapper of this library emits created events by walking the directory. So, in order not to lose any events we need to guarantee that we won't interrupt this flow - we will always walk the directory - and accumulate any errors during this process which we will return only at the end.

Checklist

• My code follows the style guidelines of this project
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• I have made corresponding change to the default configuration files
• I have added tests that prove my fix is effective or that my feature works
• I have added an entry in CHANGELOG.next.asciidoc or CHANGELOG-developer.next.asciidoc.

Author's Checklist

N/A

How to test this PR locally

Already tested here

Related issues

• Closes https://github.com/elastic/ingest-dev/issues/3268

Use cases

N/A

Screenshots

N/A

Logs

N/A

---

This is an automatic backport of pull request #39362 done by Mergify.

[botelastic]

This pull request doesn't have a Team:<team> label.

[elasticmachine]

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS

Expand to view the summary

Build stats

• Duration: 40 min 38 sec

❕ Flaky test report

No test was executed to be analysed.

🤖 GitHub comments

Expand to view the GitHub comments

To re-run your PR in the CI, just comment with:

• /test : Re-trigger the build.

• /package : Generate the packages and run the E2E tests.

• /beats-tester : Run the installation tests with beats-tester.

• run elasticsearch-ci/docs : Re-trigger the docs validation. (use unformatted text in the comment!)

[mergify]

This pull request has not been merged yet. Could you please review and merge it @pkoutsovasilis? 🙏