Deprecate `procfs` backend for `add_session_metadata`
- Dominant language
- Go
- Stars
- 12.7k
- Forks
- 5k
- Avg merge
- 2d 15m
- Merged PRs (30d)
- 385
Description
As recently demonstrated here (https://github.com/elastic/beats/pull/42398), the procfs backend for the session metadata processor is extremely prone to data loss by nature of its design, and the kprobe-based backend generally works better for most things.
However, we need some kind of strategy for actually deprecating this, since its still used as a fallback, and is probably seeing some amount of use on systems where permission issues prevent the kprobe backend from starting up. We need some kind of documentation, most likely geared towards k8s/docker users, telling them what permissions switches to flip in order to get the kprobe backend working.
There's two steps to this:
- [ ] Figure out what docs we need, and write them
- [ ] Add a deprecation warning message to the `procfs` backend
Contributor guide
Research direction
Start by reviewing the procfs and kprobe backends for add_session_metadata, then inspect the linked pull request and existing Kubernetes/Docker guidance. Identify the permissions needed for the kprobe backend, document them for those deployments, and add a deprecation warning to the procfs backend.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- docker, go, kubernetes
- Domain
- backend, devops, documentation
- Issue type
- Refactor
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 52/100