Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

should not emit fsnotify watcher error for files match excluded_files pattern #21278

Closed
newly12 opened this issue Sep 24, 2020 · 2 comments · Fixed by #21282
Closed

should not emit fsnotify watcher error for files match excluded_files pattern #21278

newly12 opened this issue Sep 24, 2020 · 2 comments · Fixed by #21282

Comments

@newly12
Copy link
Contributor

newly12 commented Sep 24, 2020

Describe the enhancement:
as title

Describe a specific use case for the enhancement or feature:
warning errors are flooding while there is no way to stop it, sample logs is attached as below, some paths of source code in the stack trace are masked.

2020-09-24T02:24:13.740Z        WARN    [file_integrity]        file_integrity/eventreader_fsnotify.go:151      fsnotify watcher error  {"error": "failed to visit created path '/run/containerd/io.containerd.runtime.v1.linux/k8s.io/2e29f16a651a5b6a94365a3132b563a2c3362f5546972fdc783f3d6071542831/rootfs/etc/runit/runsvdir/default/mcelog/supervise/stat.new': path component stat.new not found in /run/containerd/io.containerd.runtime.v1.linux/k8s.io/2e29f16a651a5b6a94365a3132b563a2c3362f5546972fdc783f3d6071542831/rootfs/etc/runit/runsvdir/default/mcelog/supervise/stat.new", "errorVerbose": "path component stat.new not found in /run/containerd/io.containerd.runtime.v1.linux/k8s.io/2e29f16a651a5b6a94365a3132b563a2c3362f5546972fdc783f3d6071542831/rootfs/etc/runit/runsvdir/default/mcelog/supervise/stat.new\nfailed to visit created path '/run/containerd/io.containerd.runtime.v1.linux/k8s.io/2e29f16a651a5b6a94365a3132b563a2c3362f5546972fdc783f3d6071542831/rootfs/etc/runit/runsvdir/default/mcelog/supervise/stat.new'\ngithub.com/elastic/beats/v7/auditbeat/module/file_integrity/monitor.(*recursiveWatcher).forwardEvents\n\t/go/src/xxx/xxx/beats-xxx/vendor/github.com/elastic/beats/v7/auditbeat/module/file_integrity/monitor/recursive.go:168\nruntime.goexit\n\t/usr/local/go/src/runtime/asm_amd64.s:1373"}
@botelastic botelastic bot added the needs_team Indicates that the issue/PR needs a Team:* label label Sep 24, 2020
@andresrc andresrc added the Team:Services (Deprecated) Label for the former Integrations-Services team label Sep 24, 2020
@elasticmachine
Copy link
Collaborator

Pinging @elastic/integrations-services (Team:Services)

@botelastic botelastic bot removed the needs_team Indicates that the issue/PR needs a Team:* label label Sep 24, 2020
@andresrc andresrc added Team:SIEM and removed Team:Services (Deprecated) Label for the former Integrations-Services team labels Sep 28, 2020
@elasticmachine
Copy link
Collaborator

Pinging @elastic/siem (Team:SIEM)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging a pull request may close this issue.

3 participants