Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Auditbeat] Update to go-libaudit v2.3.0 #31519

Merged
merged 1 commit into from
May 5, 2022
Merged

[Auditbeat] Update to go-libaudit v2.3.0 #31519

merged 1 commit into from
May 5, 2022

Conversation

andrewkroh
Copy link
Member

@andrewkroh andrewkroh commented May 4, 2022 •
edited
Loading

What does this PR do?

Updated the go-libaudit library version to v2.3.0. This refreshes the syscall
names for Linux and adds ECS categorizations for more audit anomaly events.

https://github.com/elastic/go-libaudit/releases/tag/v2.3.0

Why is it important?

This refreshes the lookup tables to handle new syscalls in Linux.

Checklist

  • My code follows the style guidelines of this project
  • I have commented my code, particularly in hard-to-understand areas
  • I have made corresponding changes to the documentation
  • I have made corresponding change to the default configuration files
  • I have added tests that prove my fix is effective or that my feature works
  • I have added an entry in CHANGELOG.next.asciidoc or CHANGELOG-developer.next.asciidoc.

@botelastic botelastic bot added needs_team Indicates that the issue/PR needs a Team:* label and removed needs_team Indicates that the issue/PR needs a Team:* label labels May 4, 2022
@andrewkroh
Update to go-libaudit v2.3.0
c4fe1b8 
Updated the go-libaudit library version to v2.3.0. This refreshes the syscall
names for Linux and adds ECS categorizations for more audit anomaly events.

https://github.com/elastic/go-libaudit/releases/tag/v2.3.0
@andrewkroh andrewkroh force-pushed the enhancement/ab/go-libaudit-v2-3-0 branch from b5771a8 to c4fe1b8 Compare May 4, 2022 16:35
@elasticmachine
Copy link
Collaborator

💚 Flaky test report

Tests succeeded.

🤖 GitHub comments

To re-run your PR in the CI, just comment with:

  • /test : Re-trigger the build.

  • /package : Generate the packages and run the E2E tests.

  • /beats-tester : Run the installation tests with beats-tester.

  • run elasticsearch-ci/docs : Re-trigger the docs validation. (use unformatted text in the comment!)

@andrewkroh
Copy link
Member Author

andrewkroh commented May 4, 2022 •
edited
Loading

E2E tests failure appears unrelated and similar failures can be found in test runs from main (example).

   Scenario Outline: Adding diskio system/metrics Integration to a Policy # features/system_integration.feature:5
     When the policy is updated to have "system/metrics" set to "diskio" # features/system_integration.feature:8
       Error: Unable to find package system in policy 3d51cc50-cbdb-11ec-b3fe-81c6dae1214b

@andrewkroh andrewkroh marked this pull request as ready for review May 4, 2022 19:20
@andrewkroh andrewkroh requested a review from a team as a code owner May 4, 2022 19:20
@andrewkroh andrewkroh requested review from rdner and fearful-symmetry and removed request for a team May 4, 2022 19:20
@elasticmachine
Copy link
Collaborator

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

@andrewkroh andrewkroh requested a review from a team May 4, 2022 19:24
@andrewkroh andrewkroh added the backport-v8.3.0 Automated backport with mergify label May 5, 2022
@andrewkroh andrewkroh merged commit f2f85e6 into elastic:main May 5, 2022
andrewkroh added a commit to andrewkroh/beats that referenced this pull request May 5, 2022
@andrewkroh
auditbeat - Add backlog_wait_time_actual to show-status
c1d900c 
Now that go-libaudit support backlog_wait_time_actual this field
can be output from the show-status command on Linux 5.9+ kernels.

There were no tests for this code so I did a quick manual smoke test
on 5.10.

Relates elastic#31519
@andrewkroh andrewkroh mentioned this pull request May 5, 2022
Merged
6 tasks
andrewkroh added a commit to andrewkroh/beats that referenced this pull request May 5, 2022
@andrewkroh
auditbeat - Add backlog_wait_time_actual to show-status
e94c4b4 
Now that go-libaudit support backlog_wait_time_actual this field
can be output from the show-status command on Linux 5.9+ kernels.

There were no tests for this code so I did a quick manual smoke test
on 5.10.

Relates elastic#31519
andrewkroh added a commit that referenced this pull request May 8, 2022
@andrewkroh
[auditbeat] Add backlog_wait_time_actual to show-status output (#31535)
dfd88c0 
* auditbeat - Add backlog_wait_time_actual to show-status

Now that go-libaudit support backlog_wait_time_actual this field
can be output from the show-status command on Linux 5.9+ kernels.

There were no tests for this code so I did a quick manual smoke test
on 5.10.

Relates #31519

* satisfy the linter gods

Fixes: use of `fmt.Println` forbidden by pattern `fmt.Print.*` (forbidigo)
@barkbay barkbay mentioned this pull request May 12, 2022
Closed
chrisberkhout pushed a commit that referenced this pull request Jun 1, 2023
@andrewkroh @chrisberkhout
Update to go-libaudit v2.3.0 (#31519)
997e897 
Updated the go-libaudit library version to v2.3.0. This refreshes the syscall
names for Linux and adds ECS categorizations for more audit anomaly events.

https://github.com/elastic/go-libaudit/releases/tag/v2.3.0
chrisberkhout pushed a commit that referenced this pull request Jun 1, 2023
@andrewkroh @chrisberkhout
[auditbeat] Add backlog_wait_time_actual to show-status output (#31535)
58c9128 
* auditbeat - Add backlog_wait_time_actual to show-status

Now that go-libaudit support backlog_wait_time_actual this field
can be output from the show-status command on Linux 5.9+ kernels.

There were no tests for this code so I did a quick manual smoke test
on 5.10.

Relates #31519

* satisfy the linter gods

Fixes: use of `fmt.Println` forbidden by pattern `fmt.Print.*` (forbidigo)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@efd6 efd6 efd6 approved these changes

@rdner rdner Awaiting requested review from rdner rdner was automatically assigned from elastic/elastic-agent-data-plane

@fearful-symmetry fearful-symmetry Awaiting requested review from fearful-symmetry fearful-symmetry was automatically assigned from elastic/elastic-agent-data-plane

Assignees

@andrewkroh andrewkroh

Labels
Auditbeat backport-v8.3.0 Automated backport with mergify enhancement
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
3 participants
@andrewkroh @elasticmachine @efd6