Auditbeat recursive file watches for Windows #6893
Conversation
adriansr
force-pushed
the
fix/auditbeat/6864
branch
from
cdf6c1b
to
daad122
Compare
adriansr
force-pushed
the
fix/auditbeat/6864
branch
6 times, most recently
from
b62f997
to
9eaf837
Compare
adriansr
changed the title
adriansr
added
bug
enhancement
review
and removed
in progress
|
I don't see the fsnotify changes to add Do you plan to try to contribute those changes upstream? I think I'd like to keep the import statements as |
adriansr
force-pushed
the
fix/auditbeat/6864
branch
from
9eaf837
to
23db875
Compare
|
@andrewkroh answered your comment in adriansr/fsnotify and changed the dependency to fsnotify/fsnotify as well |
|
|
||
| addWatchesFirst := runtime.GOOS != "windows" | ||
|
|
||
| if addWatchesFirst { |
There was a problem hiding this comment.
What's the benefit of configuring the paths before Start'ing in the non-windows case?
There was a problem hiding this comment.
I was afraid it could introduce problems in platforms other than Windows. That's why I created the system test, but at the end forgot to update this code.
I've pushed a new version were watches are always installed after Start().
Allow system tests to search for text in the beat logfile using case-insensitive search. This is necessary to match paths in case-insensitive file systems, where the path logged may have different capitalisation than the one used in the system test.
adriansr
force-pushed
the
fix/auditbeat/6864
branch
4 times, most recently
from
0414de1
to
307d779
Compare
Under Windows, directories to be watched need to be installed after the event consumer loop is started. Otherwise there's a chance of a potential deadlock, as fsnotify under Windows uses a single goroutine to deliver events and install watches. If the channel it uses to deliver events is full, it will block and won't be able to install further watches.
This patch enables OS-supported recursive watching in fsnotify if it is available. Currently only supported under Windows via our custom fsnotify fork.
adriansr
force-pushed
the
fix/auditbeat/6864
branch
from
307d779
to
9f86b3a
Compare
|
It looks like Windows CI in green now. 👍 Did you want these changes squashed or left as is? |
|
No squash please |
|
I totally read that as "No, squash please". 🤦♂️ |
Added recursive file watches support to Auditbeat using the Windows API
This helps prevent a deadlock under Windows when a lot of file events are generated while watches are being installed.
Fixes #6864