From b4ba7dbe1335445c05f73fc9be95db784a98acd9 Mon Sep 17 00:00:00 2001 From: Christoph Wurm Date: Wed, 19 Dec 2018 20:56:02 +0000 Subject: [PATCH] [Auditbeat] Cherry-pick #9669 and #9682 to 6.x: Skip processes that do not exist anymore (#9688) A process can exit just after we get a list of PIDs, but before we get around to reading that process. This skips such processes as if we had not seen their PID in the first place. (cherry picked from commit 2a859fb39b50c4cef9525a05af9696bbfed7bb75) (cherry picked from commit 3702f1625cb7b46e82a65a8ef80a47515e4112d4) (cherry picked from commit 3d3843189780fc801000ecd87a27824df0989b5a) --- x-pack/auditbeat/module/system/process/process.go | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/x-pack/auditbeat/module/system/process/process.go b/x-pack/auditbeat/module/system/process/process.go index 1ad13966f9b..7bcf1507c7e 100644 --- a/x-pack/auditbeat/module/system/process/process.go +++ b/x-pack/auditbeat/module/system/process/process.go @@ -287,11 +287,22 @@ func (ms *MetricSet) getProcessInfos() ([]*ProcessInfo, error) { for _, pid := range pids { process, err := sysinfo.Process(pid) if err != nil { + if os.IsNotExist(err) { + // Skip - process probably just terminated since our call + // to Pids() + continue + } return nil, errors.Wrap(err, "failed to load process") } pInfo, err := process.Info() if err != nil { + if os.IsNotExist(err) { + // Skip - process probably just terminated since our call + // to Pids() + continue + } + if os.Geteuid() != 0 { if os.IsPermission(err) || runtime.GOOS == "darwin" { /*