elastic / elastic/beats

Deprecate `procfs` backend for `add_session_metadata`

Open
#42,934 3 comments 0 reactions 0 assignees View on GitHub
Team:Security-Service Integrations
Dominant language
Go
Stars
12.7k
Forks
5k
Avg merge
2d 15m
Merged PRs (30d)
385

Description

As recently demonstrated here (https://github.com/elastic/beats/pull/42398), the procfs backend for the session metadata processor is extremely prone to data loss by nature of its design, and the kprobe-based backend generally works better for most things.

However, we need some kind of strategy for actually deprecating this, since its still used as a fallback, and is probably seeing some amount of use on systems where permission issues prevent the kprobe backend from starting up. We need some kind of documentation, most likely geared towards k8s/docker users, telling them what permissions switches to flip in order to get the kprobe backend working.

There's two steps to this:

- [ ] Figure out what docs we need, and write them
- [ ] Add a deprecation warning message to the `procfs` backend

Contributor guide

Open the contributing guide

Research direction

Start by reviewing the procfs and kprobe backends for add_session_metadata, then inspect the linked pull request and existing Kubernetes/Docker guidance. Identify the permissions needed for the kprobe backend, document them for those deployments, and add a deprecation warning to the procfs backend.

Written by the indexing model from the issue text.

Assessment

Tech stack
docker, go, kubernetes
Domain
backend, devops, documentation
Issue type
Refactor
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
52/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.