Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description
Some users have reported problems with Filebeat after installing wazuh related to SIGABRT.
The error it throws is "filebeat[21584]: SIGABRT: abort"
Until now, the error could only be reproduced on systems that have GLIBC v2.35 installed.
After an analysis it was found that the way to solve it is to add the following to the Filebeat template:
Tests were performed on all recommended systems and a few more. The tests consisted of trying to reproduce the error and then applying the changes to the Filebeat template. Then check, if the error could be reproduced, it is not generated anymore; and if it couldn't be reproduced, that these changes don't have any other unwanted impact on Filebeat.
Logs example
Tests
Summary of tests:
wazuh/wazuh-packages#1665 (comment)
System test:
wazuh/wazuh-packages#1665 (comment)
wazuh/wazuh-packages#1665 (comment)
wazuh/wazuh-packages#1665 (comment)
wazuh/wazuh-packages#1665 (comment)
wazuh/wazuh-packages#1665 (comment)