[Auditbeat] Cherry-pick elastic#9669 and elastic#9682 to 6.x: Skip pr…

…ocesses that do not exist anymore (elastic#9688)

A process can exit just after we get a list of PIDs, but before we get around to reading that process. This skips such processes as if we had not seen their PID in the first place.

(cherry picked from commit 2a859fb)
(cherry picked from commit 3702f16)

x-pack/auditbeat/module/system/process/process.go

@@ -287,11 +287,22 @@ func (ms *MetricSet) getProcessInfos() ([]*ProcessInfo, error) {
 	for _, pid := range pids {
 		process, err := sysinfo.Process(pid)
 		if err != nil {
+			if os.IsNotExist(err) {
+				// Skip - process probably just terminated since our call
+				// to Pids()
+				continue
+			}
 			return nil, errors.Wrap(err, "failed to load process")
 		}
 
 		pInfo, err := process.Info()
 		if err != nil {
+			if os.IsNotExist(err) {
+				// Skip - process probably just terminated since our call
+				// to Pids()
+				continue
+			}
+
 			if os.Geteuid() != 0 {
 				if os.IsPermission(err) || runtime.GOOS == "darwin" {
 					/*